NGA CORE Modernization RFI_GOLD.pdf

UNCLASSIFIED

NGA

REQUEST FOR INFORMATION

1.0 DESCRIPTION & PURPOSE

1.1 The National Geospatial-Intelligence Agency (NGA) in support of the newly-formed

Platform Services office within PEO-Enterprise IT, is seeking information on how an interested contractor could provide cost-effective modernization, software pipeline/ platform engineering and architecture expertise, and readily deployable capabilities to extend our world-class

Development, Security, and Operations (DevSecOps) environment while enhancing operational efficiencies of our existing platform. These efficiencies require a unique combination of expert technical, Department of War (DoW) and Intelligence Community (IC) process and policy expertise along with modern cloud software development and operations at medium to large enterprise scale.

1.2 The purpose of this Request for Information (RFI) is to gain information on technical solutions and industry practices that would meet NGA’s current and future requirements for the following:

• RFI 1: Operations, sustainment and concurrent modernization of our current DevSecOps environment—known as “NGA Common Operations Release Environment (NGA

CORE)”—and associated capabilities with focus on scalability, affordability and effectiveness.

• RFI 2: Direct (“hands-on”) engineering, architectural, coding, integration, on-boarding and product management expertise in the support of current and, proposed future capabilities with specific focus on principal engineering and development support of the

Kubernetes deployment and container orchestration platform across NGA’s security domains.

Vendors are encouraged to submit responses to one or all of the RFIs in accordance with the page limitations listed in section 4 - Responses.

1.3 THIS IS A REQUEST FOR INFORMATION (RFI) ONLY. This RFI is issued solely for information and planning purposes – it does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. This RFI does not commit the Government to contract for any supply or service whatsoever. Further, NGA is not at this time seeking proposals and will not accept unsolicited proposals. Responders are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI. All costs associated with responding to this RFI will be solely at the interested party’s expense. Not responding to this RFI does not preclude participation in any future RFP, if any is issued.

2.0 BACKGROUND

NGA integrated, delivered and currently operates a modern DevSecOps environment on four security domains. This includes Impact Level (IL) 2, IL4, IL6 and Top Secret/SCI environments hosted on AWS, as well as an edge production-only instance at multiple OCONUS sites, some of which are air-gapped for security purposes. The DevSecOps environment is currently comprised of:

• Collaboration tools – Rocket.Chat

• Version control – GitLab;

• Continuous Integration/Continuous Delivery (CI/CD) - GitLab runners;

• Platform as a Service (“PaaS”) - Red Hat - OpenShift;

• Monitoring - Grafana/Elastic;

• Code/Security test tools - Fortify, SonarQube, OWASP Anchore, Grype

• Self-Service - allowing teams to self-provision DevOps tools/environment

• Developer desktops - FidOS, AWS Workspaces;

• Evaluation and experimentation space - Blue Factory, test namespaces);

• Machine Learning Operations (ML-Ops);

• Enterprise messaging – Pulsar

The environment also includes mission workflow tools and an operating environment that allows rapid delivery / configuration / reconfiguration of algorithms. All tooling is integrated with enterprise services (e.g., IAA, Audit, Cybersecurity) and is accredited for operations on all domains as well as at the edge. NGA intends to provide containerized applications at the edge for use by intermittently connected and disconnected users.

NGA advocates a “build low” move high model. As such, parity of tooling and processes across security domains is essential. NGA’s current implementation is at or near parity with the commercial (open source) software baselines and NGA treats all DevSecOps tools as

“Infrastructure as Code.” Likewise, NGA is committed to singular baseline of a distributed version control and is looking to advance in areas including observability, distributed container registry and user (analyst) configurable workflows. The current government/contractor team is tightly integrated with our security office which provided the foundation for pioneering achievements such as “authority to operate” (ATO)-in-a-Day and “like-in-kind” authorizations which are based on rigorous compliance with security CONOPS, version control, automated deployments (only) and related operational and security best practices.

Respondents are asked to provide responses that address the above requirements with an emphasis on lifecycle affordability, operational efficiency, security, scalability, and ease of integration with existing systems. Responses must demonstrate solutions that follow industry standards, are modular, forward-compatible, and platform agnostic to the maximum extent practicable allowing for the integration of additional technologies and services as operational demands evolve.

Respondents are requested to specifically identify and address perceived execution risk factors

(people, process, technology) associated with their proposed mitigations/solutions, with particular attention to implementation timeframes. Further any proposed environments/platforms should be fully demonstratable and operational (less any identified constraints) upon the Government’s request—via live or virtual means. All respondents are requested to provide evidence of past performance in classified DoW/IC environments, along with contact information for Government points of contact for said performance.

2.1 PLANNED ACQUISITION:

RFI 1: Our organization seeks information on proposed technical solutions to deliver comprehensive services across classified security domains ensuring the operational readiness, sustainment, and enhancement of the existing NGA CORE platform. The contractor will provide all necessary resources to manage and execute the following key product lines:

• Developer Experience: Maker and Builder tradecraft resources, guidance, and enhancements to accelerate NGA developer experience and proficiency. Capabilities include:

o External Cloud: Supporting a variety of workloads running in a commercial cloud environment outside the DoD network perimeter to include footprints in higher-security clouds (e.g. AWS GovCloud region, Azure Government, or other

FedRAMP+ providers).

o Blue Factory Environment: Supplementing development environments by providing cloud-based services that can scale to prove out large data or large compute requirements (e.g. access to cloud native capability such as SageMaker) o Commercial Cloud Services: Providing a reliable, scalable, and inexpensive cloud computing service.

o On-boarding, including white glove option

• DevSecOps Tooling: The aggregation of tools necessary to provide a “barrier free” development-test-operations environment that support continuous integration/continuous delivery. (e.g. GitLab, Nexus, Harbor, SonarQube, Fortify, OWASP, Rocket.Chat)

• API Management: Extending the reach of GEOINT data, products and platforms to customers by providing easy to use interfaces with prescribed processes for managing, publishing, and promoting API development, deployment and usability (e.g. Kong)

• PaaS: Providing a complete industry standard, service-based platform for customers to develop, run, and manage their applications (e.g. Red Hat Open Shift)

• Continuous Monitoring and Operations: Provides design, implementation, and operation of Real-time monitoring and direct customer support for the CORE tools (e.g. Elastic, Metric Beats, Grafana)

• Workflow Orchestration: Developers and scientists enabling rapid multi-INT and non-literal data analysis with containerized, discoverable, and linkable tools (e.g. Government developed “open-source” software; Argo baseline )

• Messaging: Efficient, flexible, and resilient service-to-service communication across the enterprise fabric to enable efficient and dynamic connectivity between systems, services, and users (e.g. Pulsar)

• Work Tracking: Enterprise-managed work tracking and collaboration tools to document features to be built, defects to be fixed, design details, and decisions by development teams

(e.g. JIRA/Confluence)

• Integration: Collaboration with other teams including and capabilities including IAA.

Audit, Test, container & software movement (e.g., version parity of tools and containers across all security domains)

In addition to, and in concert with, the above, respondents are asked to provide input on solutions and feasibility of the concurrent design and management of a scalable, cost-controlled software production environment comprised of industry standard interchangeable/upgradable capabilities, processes, policy and tools to deliver mission-focused products agnostic of infrastructure. The objectives for this future state environment, which is critical for supporting NGA’s development of critical products and applications, are as follows:

• Site Reliability Engineering to proactively address pipeline, cross-domain, platform, tooling test and other issues and assist users in optimizing applications for the PaaS

• Developing templates, pipelines and associated documentation, labs and related efforts to ease the developer journey from idea to operations with limited exposure to DoW and IC environments (improving software capability delivery velocity while expanding the pool of software developer candidates that can be successful in the environment)

• Ensuring an affordable, reliable, highly available architecture and assist application developers in utilizing the tooling and environment to deliver High Availability (HA) applications

• Integration with NGA Enterprise tools such as Service Now along with other COTS product for auto deploy, auto patch, auto-scale

• Ensure that solutions are consistent with industry standards, modular, scalable, etc.

RFI 2: Our organization requires DevSecOps pipeline and platform engineering and architecture subject matter expertise and direct support in delivery of current, and proposed future state, capabilities comprising a continuously evolving and user-focused development and deployment framework. Specific focus areas include principal engineering and software development experts with demonstrable knowledge (e.g., principle/senior/expert full stack developers) of Kubernetes applications on classified systems with specific focus on areas such as:

• Container orchestration

• Distributed dedicated architecture

• Various commercial cloud providers via abstraction such as Open Container Initiative compliance)

• Implementations in on-prem, cloud, and edge data center environments

• Single and multi-tenant clusters (current baseline is multi-tenant)

• Integrating the enterprise solution with future High-Performance Compute (HPC) environments

2.2 PERFORMANCE:

2.2.1 PERIOD (POP): Anticipated period of performance would be One Base Period with multiple option-periods

2.2.2 LOCATION(S): CONUS, site location TBD based on RFI input

2.3 CONSTRAINTS AND LIMITATIONS: The following are anticipated to apply to this acquisition:

(e.g., does this fit into the current architecture, links to documents in a bidder’s library, anything that would help industry better understand the current environment.

TBD

2.4 SECURITY REQUIREMENTS: The following security requirements are anticipated to apply to this acquisition: (Note that all of the personnel the responder anticipates would perform the needed services would need to possess the appropriate security clearance at the time of proposal or quotation submission.)

• Respondents must have or be able to obtain access to NGA and its sites at the TS/SCI level

2.5 ORGANIZATIONAL CONFLICT OF INTEREST: In accordance with FAR Part 9.5, please discuss any performance which may lead to an OCI and how the Offeror would mitigate, avoid, or neutralize the conflict.

3.0 REQUESTED INFORMATION

Responses must only contain UNCLASSIFIED information and be marked “UNCLASSIFIED” on all pages in both the header and footer. No classified information may be included in your response.

Neither proprietary or classified concepts, nor classified information should be included in the submittal. Input on the information contained in the responses may be solicited and reviewed by

NGA non-Government consultants or experts who are bound by appropriate non-disclosure agreements.

3.1 ADMINISTRATIVE

Information to include as a minimum:

3.1.1. Name, mailing address, overnight delivery address (if different from mailing address), phone number, fax number, company website, and e-mail of designated point(s) of contact.

3.1.2. BUSINESS TYPE.

Based upon North American Industry Classification System (NAICS) code 518210 – Computing

Infrastructure Provider, Data Processing, Web-Hosting and Related Services applicable to this acquisition, the responder is to provide answers to the following questions:

To be considered for a Small Business set-aside, at least 50 % of the cost of contract performance incurred for personnel shall be expended for employees of the responder.( FAR 52.219-14, Limitation of Subcontracting)

RESPONSE

Are you a Small Business? (FAR 19.102), If so, which type: ☐ YES ☐ NO

Small Disadvantaged small business? (FAR 19.304) ☐ YES ☐ NO

Service Disabled small business? (FAR 19.14) ☐ YES ☐ NO

8(a) Small Disadvantaged small business? (FAR 19.8) ☐ YES ☐ NO

HUBZone small business? (FAR 19.13) ☐ YES ☐ NO

Woman-Owned Small Business? (FAR 19.15) ☐ YES ☐ NO

Involved in a mentor and/or protégé program? (DFARS 219.71) ☐ YES ☐ NO

3.1.3 Recommendation for alternative NAICS Code? Provide rationale for any NAICS Code applicable to the planned acquisition other than the NAICS code identified above.

3.1.4 DUNS Number: _________________

3.1.5 Commercial and Government Entity (CAGE) Code: ______________________________ http://www.census.gov/cgi-bin/sssd/naics/naicsrch?chart=2012 http://www.naics.com/naicsfiles/Size_Standards_Table2013.pdf http://www.acquisition.gov/far/current/html/Subpart%2019_1.html http://www.acquisition.gov/far/current/html/Subpart%2019_3.html http://www.acquisition.gov/far/current/html/Subpart%2019_14.html#wp1093836 http://www.acquisition.gov/far/current/html/Subpart%2019_8.html#wp1092796 http://www.acquisition.gov/far/current/html/Subpart%2019_13.html#wp1094801 http://www.acquisition.gov/far/current/html/Subpart%2019_15.html#wp1094868 http://www.acq.osd.mil/dpap/dars/dfars/html/current/219_71.htm

3.1.6 Defense facility security clearance? What type? What level? _______________________

3.1.7 Accounting system, if applicable? Date of last audit? Audit performed by? Determined adequate/inadequate? ___________________________________________________________

3.1.8 Purchasing system? Date determined adequate or inadequate? ______________________

3.1.9 Timekeeping system? Date of last audit? Who performed? Determined adequate/inadequate? ___________________________________________________________

3.1.10 Do you hold a GSA Federal Supply Schedule (FSS) contract applicable to the NAICS code (s) identified above? If yes, provide contract number(s). _____________________________

3.1.11 Are you registered in SAM? _________________________________________________

3.1.12 Are you interested in: Prime contract? Teaming to include Joint Venture? Subcontractor opportunities? _________________________________________________________________

3.1.13 Include additional details that are not already requested based on the constraints of the information request.

3.2 EXPERIENCE

3.2.1 COMMERCIAL.

Provide relevant details on the responder providing the same or similar services offered or made to the general public or to non-governmental entities for purposes other than governmental purposes in the last three (3) years. Relevant details to NGA’s proposed acquisition should include, but not be limited to, information regarding the contract value, size and length of the effort, responder performing as a prime or subcontractor, customary practices (warranty, financing, discounts, contract types, etc.) under which the sales of the service(s) are made, security details, the customary practices regarding customizing, modifying, or tailoring of a service(s) to meet customer needs and associated costs, the kinds of factors that are used to evaluate performance; the kinds of performance incentives used; the kinds of performance assessment methods commonly used; the common qualifications of the people performing the services; and requirements of law and/or regulations unique to these service(s), that can demonstrate the responder’s abilities and capacity to meet NGA’s statement of objectives.

3.2.2 GOVERNMENT.

Provide relevant details on the responder providing the same or similar services offered or made to U.S. Government agencies other than NGA in the last three (3) years. Relevant details to

NGA’s proposed acquisition should include, but not be limited to contract value, information regarding the contract number, agency, responder performing as a prime or subcontractor, size and length of the effort, type of pricing and/or cost, security details, the kinds of factors used to evaluate performance; the kinds of performance incentives; the kinds of performance assessment methods; the qualifications of the people performing the services; and any unique terms and conditions, that can demonstrate the responder’s abilities and capacity to meet NGA’s statement of objectives.

3.2.3 NGA.

Provide relevant details on the responder providing the same or similar services offered or made to NGA in the last three (3) years. Relevant details to NGA’s proposed acquisition should include, but not be limited to contract value, information regarding the contract number, program name, size and length of the effort, responder performing as a prime or subcontractor, type of pricing and/or cost, security details, the kinds of factors used to evaluate performance; the kinds of performance incentives; the kinds of performance assessment methods; the qualifications of the people performing the services; and any unique terms and conditions, that can demonstrate the responder’s abilities and capacity to meet NGA’s statement of objectives.

3.3 CAPABILITIES

The following is the responder’s capabilities to meet the proposed acquisition set forth in section

2 of this RFI including the Statement of Objectives, Statement of Work, or Performance Work

Statement.

3.3.1 Government requirements needed to support the RFI statement of objectives

3.3.1.1 Requirement capabilities that the responder currently possesses. Responses should include the relevant information regarding specific skills, experience, and security clearances that its employees, by labor category, currently possess in performing these services, and any needed hardware or software.

3.3.1.2 Detail the service capabilities that the responder currently does not possess in order to meet the SOO, SOW, or PWS.

3.3.2 Recommended type of pricing for this type of service (e.g. FFP, FPIF CPIF).

3.3.3 Extent to which the responder has the ability to meet the proposed acquisition.

3.3.4 Notional schedule and type of plan for transition-in and transition-out (based on previous or similar work efforts).

3.3.5 Security capabilities and plans that demonstrate the ability to meet NGA’s security requirements beginning at contract award and throughout the POP.

3.3.7 Intellectual Property/Data Rights offered to the Government as part of the proposed solution(s).

3.4 RECOMMENDATIONS

The responder is invited to provide information and recommendations for fashioning this proposed acquisition. Recommendation areas may include the type of contract, anticipated contract terms & conditions, incentives, variations in delivery schedule, price and/or cost proposal support, and data requirements, contract pricing, and any other areas that the responder believes is relevant for the Government to achieve its stated objectives. The responder may opine regarding what portion of the work could be set-aside for small businesses if all the required work cannot be provided by a small business. Details to support any recommendations for partial small business set-asides should be included.

4.0 RESPONSES

4.1 Interested parties are directed to respond to this RFI with a white paper.

4.2 White paper shall be in Microsoft Word for Office or compatible format and shall not exceed 12 pages. A page is defined as each face of an 8½” x 11” sheet with information contained within a one-inch margin on all sides. Font type shall be Times Roman 12 point.

4.2.1 Interested parties are encouraged to utilize the Comment Matrix format in their white paper when providing comments, questions, and/or suggestions.

4.3 Responses containing the white paper are due no later than 5:00 pm ET on 20 February

2026. Responses may be uploaded to the CORE Modernization effort on the classified ACR site

OR emailed to Charlene.K.Fowler@nga.mil and Travarus.D.Davis@nga.mil.

5.0 MEETINGS AND DISCUSSIONS

The Government representatives may or may not choose to meet with potential RFI service provider(s). Such meetings and discussions would only be intended to get further clarification of potential capability, especially any development and certification risks.

6.0 QUESTIONS

Questions regarding this RFI are due not later than 12:00 Noon ET 30 January 2026. Questions may be uploaded to the CORE Modernization effort on the classified ARC site OR emailed to

Charlene.K.Fowler@nga.mil and Travarus.D.Davis@nga.mil. .

7.0 SUMMARY

This RFI is only intended for the Government to identify sources that can provide the needed services to fulfill the Government’s statement of objectives. The information provided in this

RFI is subject to change and is not binding to the Government. The Government has not made a commitment to procure any of the RFI requirements discussed, and release of this RFI should not be construed as such a commitment or as authorization to incur cost for which reimbursement would be required or sought. All submissions become Government property and will not be returned.

mailto:Charlene.K.Fowler@nga.mil mailto:Travarus.D.Davis@nga.mil mailto:Charlene.K.Fowler@nga.mil mailto:Travarus.D.Davis@nga.mil

COMMENT MATRIX FOR THE Platform Services Office

REQUEST FOR INFORMATION

COMMENT

RFI PAGE

RFI

SECTION

COMMENT/QUESTION/SUGGESTION