NGA CORE Helm-IaC RFI_GOLD.pdf

UNCLASSIFIED

NGA

REQUEST FOR INFORMATION

1.0 DESCRIPTION & PURPOSE

1.1 The National Geospatial-Intelligence Agency (NGA) in support of the newly-formed

Platform Services office within PEO-Enterprise IT, is seeking information on how an interested contractor would implement a cost-effective, “Configuration as a Service” centric platform, capable of delivering bundled NGA Common Operations Release Environment (CORE), Helm-

Infrastructure as a Code with respect to constraints presented by the Department of War (DoW), the Intelligence Community (IC) and NGA-specific IT system and cyber requirements.

1.2 The purpose of this Request for Information (RFI) is to gain information on technical solutions and industry practices that would meet NGA’s current and future requirements for a holistic deployment approach for NGA CORE that uses either documentation-based orchestration of ordered deployment via Infrastructure as Code / Helm or a wrapper script that coordinates the ordered execution of each product with basic error handling and retry mechanisms.

Vendors are encouraged to submit responses to one or all of the RFIs in accordance with the page limitations listed in section 4 - Responses.

1.3 THIS IS A REQUEST FOR INFORMATION (RFI) ONLY. This RFI is issued solely for information and planning purposes – it does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. This RFI does not commit the Government to contract for any supply or service whatsoever. Further, NGA is not at this time seeking proposals and will not accept unsolicited proposals. Responders are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI. All costs associated with responding to this RFI will be solely at the interested party’s expense. Not responding to this RFI does not preclude participation in any future RFP, if any is issued.

2.0 BACKGROUND

NGA integrated, delivered and currently operates a modern DevSecOps environment on four security domains. This includes Impact Level (IL) 2, IL4, IL6 and Top Secret/SCI environments hosted on AWS, as well as an edge production-only instance at multiple OCONUS sites, some of which are air-gapped for security purposes. The DevSecOps environment is currently comprised of:

• Collaboration tools – Rocket.Chat

• Version control – GitLab;

• Continuous Integration/Continuous Delivery (CI/CD) - GitLab runners;

• Platform as a Service (“PaaS”) - Red Hat - OpenShift;

• Monitoring - Grafana/Elastic;

• Code/Security test tools - Fortify, SonarQube, OWASP Anchore, Grype

• Self-Service - allowing teams to self-provision DevOps tools/environment

• Developer desktops - FidOS, AWS Workspaces;

• Evaluation and experimentation space - Blue Factory, test namespaces);

• Machine Learning Operations (ML-Ops);

• Enterprise messaging – Pulsar

The environment also includes mission workflow tools and an operating environment that allows rapid delivery / configuration / reconfiguration of algorithms. All tooling is integrated with enterprise services (e.g., IAA, Audit, Cybersecurity) and is accredited for operations on all domains as well as at the edge. NGA intends to provide containerized applications at the edge for use by intermittently connected and disconnected users.

NGA advocates a “build low” move high model. As such, parity of tooling and processes across security domains is essential. NGA’s current implementation is at or near parity with the commercial (open source) software baselines and NGA treats all DevSecOps tools as

“Infrastructure as Code.” Likewise, NGA is committed to singular baseline of a distributed version control and is looking to advance in areas including observability, distributed container registry and user (analyst) configurable workflows. The current government/contractor team is tightly integrated with our security office which provided the foundation for pioneering achievements such as “authority to operate” (ATO)-in-a-Day and “like-in-kind” authorizations which are based on rigorous compliance with security CONOPS, version control, automated deployments (only) and related operational and security best practices.

Respondents are asked to provide responses that address the above requirements with an emphasis on lifecycle affordability, operational efficiency, security, scalability, and ease of integration with existing systems. Responses must demonstrate solutions that follow industry standards, are modular, forward-compatible, and platform agnostic to the maximum extent practicable allowing for the integration of additional technologies and services as operational demands evolve.

Respondents are requested to specifically identify and address perceived execution risk factors

(people, process, technology) associated with their proposed mitigations/solutions, with particular attention to implementation timeframes. Further any proposed environments/platforms should be fully demonstratable and operational (less any identified constraints) upon the Government’s request—via live or virtual means. All respondents are requested to provide evidence of past performance in classified DoW/IC environments, along with contact information for Government points of contact for said performance.

2.1 PLANNED ACQUISITION:

The objective of this RFI is to gather insights toward the development of a capability that will:

• Provide readily deployable capabilities for the NGA CORE DevSecOps environment via bundled Helm/IaC solutions

• Support deployment to internet connected and/or air-gapped environments in an orchestrated fashion

• Include deployment solutions a set of initial CORE DevSecOps service offerings as follows:

o Source Control Management (SCM) & CI/CD Pipeline - GitLab o Artifact store - Nexus o CORE PaaS - OpenShift cluster with Kyverno policy, baseline operators and

Advanced Cluster Security for Kubernetes (ACS) o Code Quality - SonarQube o Security tools - Fortify, OWASP, Anchore, Grype

• Operate under a "bring your own license" model

• Provide support to teams that do not have an NGA affiliation for CORE product line IaC and/or Helm deployment procedures and major/minor hot fixes—no greater than 2 minor releases or 1 year (whichever is less)

• Work within constraints presented by DoW, IC, and NGA specific IT system and cyber requirements

• At least monthly, demonstrate a complete deployment of the CORE environment using the deployment approach that has been developed

In order to provide for the most thorough responses, the following are intended to be furnished to by the Government via its NGA CORE baseline:

• Provide tooling and services that empowers users to develop, build, test, scan, and deploy code that addresses NGA Mission

• Definition of the standard deployment procedures and dependencies between CORE components

• Maintenance of product line release versions that comply with Semantic Versioning 2.0.0 standards and release notes for the entire CORE product line

• Baseline configuration for security compliance within NGA environments

• Enterprise agent configurations applicable to NGA internal deployments

2.2 PERFORMANCE:

2.2.1 PERIOD (POP): Anticipated period of performance would be a One (1) Year Base Period with Four (4) One (1) Year Option-Periods

2.2.2 LOCATION(S): CONUS, site location TBD based on RFI input

2.3 CONSTRAINTS AND LIMITATIONS: The following are anticipated to apply to this acquisition:

Respondents should be mindful of the following technical and organizational dependencies external to CORE but critical in its success:

• NGA Cloud Operations (Cloud OPS) office owns and is responsible for certain cloud infrastructure before CORE product line deployments can occur o Amazon Web Services (AWS) Virtual Private Cloud (VPC) setup, networking, peering (in air-gapped domains), Amazon Machine Images (AMI's), Identity and

Access Management (IAM) roles are provisioned by Cloud OPS after onboarding approval granted to CORE by Computer Security Risk Management o Customizations to Cloud OPS provided cloud resources can be pre-coordinated by

CORE Product Teams

• NGA Risk Management office owns computer security policies, assessment and authorizations that all computer systems and must inform and abide by when any significate alterations are made to the CORE product line o Requires acceptable Static Application Security Test (SAST) / Dynamic

Application Security Testing (DAST) scan results of all code, containers, packages

(e.g., no Critical or High common vulnerabilities and exposures) o Ensures all systems comply with Department of Defense Risk Management

Framework (DoD RMF) to secure systems intelligence information systems

• Depending on classification, Login.gov or NGA directed equivalent are the designated central enterprise Identity, Credential, Access Management (ICAM) solutions all operational products must leverage o Respondents should identify a provider for all CORE users

• All systems must be configured to send audit and log data to the central NGA Enterprise

Audit endpoints for health and cyber monitoring/alerting o Integration will require pre-coordination

2.4 SECURITY REQUIREMENTS: The following security requirements are anticipated to apply to this acquisition: (Note that all of the personnel the responder anticipates would perform the needed services would need to possess the appropriate security clearance at the time of proposal or quotation submission.)

• Respondents must have or be able to obtain access to NGA and its sites at the TS/SCI level.

2.5 ORGANIZATIONAL CONFLICT OF INTEREST: In accordance with FAR Part 9.5, please discuss any performance which may lead to an OCI and how the Offeror would mitigate, avoid, or neutralize the conflict.

3.0 REQUESTED INFORMATION

Responses must only contain UNCLASSIFIED information and be marked “UNCLASSIFIED” on all pages in both the header and footer. No classified information may be included in your response.

Neither proprietary or classified concepts, nor classified information should be included in the submittal. Input on the information contained in the responses may be solicited and reviewed by

NGA non-Government consultants or experts who are bound by appropriate non-disclosure agreements.

3.1 ADMINISTRATIVE

Information to include as a minimum:

3.1.1. Name, mailing address, overnight delivery address (if different from mailing address)phone number, fax number, company website, and e-mail of designated point(s) of contact.

3.1.2. BUSINESS TYPE.

Based upon North American Industry Classification System (NAICS) code 518210 – Computing

Infrastructure Provider, Data Processing, Web-Hosting and Related Services applicable to this acquisition, the responder is to provide answers to the following questions:

To be considered for a Small Business set-aside, at least 50 % of the cost of contract performance incurred for personnel shall be expended for employees of the responder.( FAR 52.219-14, Limitation of Subcontracting)

RESPONSE

Are you a Small Business? (FAR 19.102), If so, which type: ☐ YES ☐ NO

Small Disadvantaged small business? (FAR 19.304) ☐ YES ☐ NO

Service Disabled small business? (FAR 19.14) ☐ YES ☐ NO

8(a) Small Disadvantaged small business? (FAR 19.8) ☐ YES ☐ NO

HUBZone small business? (FAR 19.13) ☐ YES ☐ NO

Woman-Owned Small Business? (FAR 19.15) ☐ YES ☐ NO

Involved in a mentor and/or protégé program? (DFARS 219.71) ☐ YES ☐ NO

3.1.3 Recommendation for alternative NAICS Code? Provide rationale for any NAICS Code applicable to the planned acquisition other than the NAICS code identified above.

3.1.4 DUNS Number: _________________

3.1.5 Commercial and Government Entity (CAGE) Code: ______________________________

3.1.6 Defense facility security clearance? What type? What level? _______________________

3.1.7 Accounting system, if applicable? Date of last audit? Audit performed by? Determined adequate/inadequate? ___________________________________________________________

3.1.8 Purchasing system? Date determined adequate or inadequate? ______________________

3.1.9 Timekeeping system? Date of last audit? Who performed? Determined adequate/inadequate? ___________________________________________________________

3.1.10 Do you hold a GSA Federal Supply Schedule (FSS) contract applicable to the NAICS code (s) identified above? If yes, provide contract number(s). _____________________________

3.1.11 Are you registered in SAM? _________________________________________________

3.1.12 Are you interested in: Prime contract? Teaming to include Joint Venture? Subcontractor opportunities? _________________________________________________________________

3.1.13 Include additional details that are not already requested based on the constraints of the information request.

3.2 EXPERIENCE

3.2.1 COMMERCIAL.

http://www.census.gov/cgi-bin/sssd/naics/naicsrch?chart=2012 http://www.naics.com/naicsfiles/Size_Standards_Table2013.pdf http://www.acquisition.gov/far/current/html/Subpart%2019_1.html http://www.acquisition.gov/far/current/html/Subpart%2019_3.html http://www.acquisition.gov/far/current/html/Subpart%2019_14.html#wp1093836 http://www.acquisition.gov/far/current/html/Subpart%2019_8.html#wp1092796 http://www.acquisition.gov/far/current/html/Subpart%2019_13.html#wp1094801 http://www.acquisition.gov/far/current/html/Subpart%2019_15.html#wp1094868 http://www.acq.osd.mil/dpap/dars/dfars/html/current/219_71.htm

Provide relevant details on the responder providing the same or similar services offered or made to the general public or to non-governmental entities for purposes other than governmental purposes in the last three (3) years. Relevant details to NGA’s proposed acquisition should include, but not be limited to, information regarding the contract value, size and length of the effort, responder performing as a prime or subcontractor, customary practices (warranty, financing, discounts, contract types, etc.) under which the sales of the service(s) are made, security details, the customary practices regarding customizing, modifying, or tailoring of a service(s) to meet customer needs and associated costs, the kinds of factors that are used to evaluate performance; the kinds of performance incentives used; the kinds of performance assessment methods commonly used; the common qualifications of the people performing the services; and requirements of law and/or regulations unique to these service(s), that can demonstrate the responder’s abilities and capacity to meet NGA’s statement of objectives.

3.2.2 GOVERNMENT.

Provide relevant details on the responder providing the same or similar services offered or made to U.S. Government agencies other than NGA in the last three (3) years. Relevant details to

NGA’s proposed acquisition should include, but not be limited to contract value, information regarding the contract number, agency, responder performing as a prime or subcontractor, size and length of the effort, type of pricing and/or cost, security details, the kinds of factors used to evaluate performance; the kinds of performance incentives; the kinds of performance assessment methods; the qualifications of the people performing the services; and any unique terms and conditions, that can demonstrate the responder’s abilities and capacity to meet NGA’s statement of objectives.

3.2.3 NGA.

Provide relevant details on the responder providing the same or similar services offered or made to NGA in the last three (3) years. Relevant details to NGA’s proposed acquisition should include, but not be limited to contract value, information regarding the contract number, program name, size and length of the effort, responder performing as a prime or subcontractor, type of pricing and/or cost, security details, the kinds of factors used to evaluate performance; the kinds of performance incentives; the kinds of performance assessment methods; the qualifications of the people performing the services; and any unique terms and conditions, that can demonstrate the responder’s abilities and capacity to meet NGA’s statement of objectives.

3.3 CAPABILITIES

The following is the responder’s capabilities to meet the proposed acquisition set forth in section

2 of this RFI including the Statement of Objectives, Statement of Work, or Performance Work

Statement.

3.3.1 Government requirements needed to support the RFI statement of objectives

3.3.1.1 Requirement capabilities that the responder currently possesses. Responses should include the relevant information regarding specific skills, experience, and security clearances that its employees, by labor category, currently possess in performing these services, and any needed hardware or software.

3.3.1.2 Detail the service capabilities that the responder currently does not possess in order to meet the SOO, SOW, or PWS.

3.3.2 Recommended type of pricing for this type of service (e.g. FFP, FPIF CPIF).

3.3.3 Extent to which the responder has the ability to meet the proposed acquisition.

3.3.4 Notional schedule and type of plan for transition-in and transition-out (based on previous or similar work efforts).

3.3.5 Security capabilities and plans that demonstrate the ability to meet NGA’s security requirements beginning at contract award and throughout the POP.

3.3.6

3.3.7 Intellectual Property/Data Rights offered to the Government as part of the proposed solution(s).

3.4 RECOMMENDATIONS

The responder is invited to provide information and recommendations for fashioning this proposed acquisition. Recommendation areas may include the type of contract, anticipated contract terms & conditions, incentives, variations in delivery schedule, price and/or cost proposal support, and data requirements, contract pricing, and any other areas that the responder believes is relevant for the Government to achieve its stated objectives. The responder may opine regarding what portion of the work could be set-aside for small businesses if all the required work cannot be provided by a small business. Details to support any recommendations for partial small business set-asides should be included.

4.0 RESPONSES

4.1 Interested parties are directed to respond to this RFI with a white paper.

4.2 White paper shall be in Microsoft Word for Office or compatible format and shall not exceed 10 pages. A page is defined as each face of an 8½” x 11” sheet with information contained within a one-inch margin on all sides. Font type shall be Times Roman 12 point.

4.2.1 Interested parties are encouraged to utilize the Comment Matrix format in their white paper when providing comments, questions, and/or suggestions.

4.3 Responses containing the white paper are due not later than 5:00 pm ET on 20 February

2026. Responses may be - uploaded to the CORE Helm-IaC effort on the classified ARC site OR emailed to Charlene.K.Fowler@nga.mil and Travarus.D.Davis@nga.mil.

5.0 MEETINGS AND DISCUSSIONS

The Government representatives may or may not choose to meet with potential RFI service provider(s). Such meetings and discussions would only be intended to get further clarification of potential capability, especially any development and certification risks.

6.0 QUESTIONS

Questions regarding this RFI are due not later than 12:00 Noon ET 30 January 2026. Questions may be uploaded to the CORE Helm-IaC effort OR emailed to Charlene.K.Fowler@nga.mil and

Travarus.D.Davis@nga.mil.

mailto:Charlene.K.Fowler@nga.mil mailto:Travarus.D.Davis@nga.mil mailto:Charlene.K.Fowler@nga.mil mailto:Travarus.D.Davis@nga.mil

7.0 SUMMARY

This RFI is only intended for the Government to identify sources that can provide the needed services to fulfill the Government’s statement of objectives. The information provided in this

RFI is subject to change and is not binding to the Government. The Government has not made a commitment to procure any of the RFI requirements discussed, and release of this RFI should not be construed as such a commitment or as authorization to incur cost for which reimbursement would be required or sought. All submissions become Government property and will not be returned.

COMMENT MATRIX FOR THE Platform Services Office

REQUEST FOR INFORMATION

COMMENT

RFI PAGE

RFI

SECTION

COMMENT/QUESTION/SUGGESTION