Q-and-A_NGA-CORE_SAM.xlsx
XLSX spreadsheet 96 KB Posted
- Solicitation number
- Not on record
About this file
This is a Questions and Answers (Q&A) document for the NGA CORE Modernization Request for Information (RFI), containing 106 numbered questions submitted by potential respondents and corresponding government responses regarding two distinct RFI tracks. The document does not address specific products or services procurement details, pricing terms, or award information, but rather clarifies NGA's technical requirements and acquisition strategy.
RFI 1 focuses on operations, sustainment, and concurrent modernization of NGA's DevSecOps environment (NGA CORE), emphasizing scalability, affordability, and effectiveness across multiple security domains (IL2, IL4, IL6, and TS/SCI). Key clarifications include: the government will not disclose incumbent contractor information; past performance in classified environments is required; respondents must submit separate white papers (maximum 12 pages each) for each RFI with 12-point font; NGA measures success through operational metrics (uptime, error rates), business metrics (cost, productivity), and DORA metrics (deployment frequency, lead time for changes); standard business hours support with 24x7 responsiveness aligned to established SLAs are required; and the government seeks industry best practices on contract type preference (FPIF, CPIF, hybrid), pricing structure, and team organization. RFI 2 addresses hands-on engineering support for platform-level DevSecOps and Kubernetes engineering across multiple security domains, with emphasis on Red Hat OpenShift as the current baseline, multi-tenant and single-tenant cluster architectures, Helm/Infrastructure-as-Code implementation as day-zero strategy, container security integration (Advanced Cluster Security and Kyverno), observability using Elastic and Grafana, and compliance with NIST 800-53, DISA STIG, and NGA's continuous monitoring dashboard (Galaxy). The government has indicated many requirements remain undetermined pending industry input, with final RFI responses due February 26, 2026, and questions accepted through January 30, 2026, submitted to the classified ARC website or via email to Charlene.K.Fowler@nga.mil and Travarus.D.Davis@nga.mil.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| NGA CORE_my_questions-ADMIN_PEP_Response_1__SBU.xlsx | XLSX spreadsheet | |
| NGA CORE Modernization RFI_GOLD.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Q&A
| No. | Document Name | Page | Section | Question/Comment/Suggestion | Government Response | CLASSIFICATION |
| 1 | NGA+CORE+Modernization+RFI_GOLD.pdf | 1 | 2.0 Background | Can NGA please provide the incumbents who provide and support the DevSecOps environment? | This information will not be provided. | UNCLASSIFIED |
| 2 | NGA+CORE+Modernization+RFI_GOLD.pdf | 2 | 2.0 Background | Can NGA please provide guidance on the frequency and FTEs for travel? | Some travel available at government discrestion for mission planning | UNCLASSIFIED |
| 3 | NGA+CORE+Modernization+RFI_GOLD.pdf | 2 | 2.0 Background | To ensure Small Business competitiveness, is NGA willing to remove the requirement of past performance in a classified DoW/IC environment? | Program Office decision. How important is past performance info? | UNCLASSIFIED |
| 4 | NGA+CORE+Modernization+RFI_GOLD.pdf | 8 | Responses | Given the level of detail for a thorough RFI response, can NGA please consider reducing the font size for tables? | Font should be 12 pt | UNCLASSIFIED |
| 5 | NGA+CORE+Modernization+RFI_GOLD.pdf | 6 | 3.2 Experience | Can NGA please clarify that respondants may choose to respond to Commericial, Government, or NGA Past Performance requirements? | Correct. | UNCLASSIFIED |
| 6 | NGA+CORE+Modernization+RFI_GOLD.pdf | 6 | 3.2.3. NGA | In consideration of Small Business participants, can NGA please consider removing the separate NGA Past Performance requirement? | Past performace as requested is required | UNCLASSIFIED |
| 7 | NGA+CORE+Modernization+RFI_GOLD.pdf | 7 | 3.3 Capabilities | Can NGA please provide the SOO, SOW, and PWS as referenced in - 3.3.1.2 Detail the service capabilities that the responder currently does not possess in order to meet the SOO, SOW, or PWS? | Seeking industry input to make determination. | UNCLASSIFIED |
| 8 | NGA+CORE+Modernization+RFI_GOLD.pdf | 7 | 3.3.2 | Can NGA please provide guidance on the current Pricing structure? | Seeking industry input to make determination. | UNCLASSIFIED |
| 9 | NGA+CORE+Modernization+RFI_GOLD.pdf | 7 | 3.3.4 | Can NGA please provide guidance on the incumbent contracts anticipated end date and the # of personnel for transition out? | This information will not be provided. | UNCLASSIFIED |
| 10 | NGA+CORE+Modernization+RFI_GOLD.pdf | 8 | Responses | Given the level of detail for a thorough RFI response, can NGA please consider reducing the font size for tables? | Font size should be 12 pt. | UNCLASSIFIED |
| 11 | NGA+CORE+Modernization+RFI_GOLD.pdf | 8 | 4.0 Responses | Given the level of detail for a thorough response, can NGA please consider extending the page count to 20 (twenty)? | White paper response is limited to 12 pages per response, a totaal of 24 pages if responding to both areas. | UNCLASSIFIED |
| 12 | NGA+CORE+Modernization+RFI_GOLD.pdf | 8 | 4.0 Responses | Given the level of detail for a thorough RFI response, can NGA please consider reducing the font size for tables? | Font size should be 12 pt. | UNCLASSIFIED |
| 13 | What is the anticipated release timeframe for the RFP, and what is the expected award and Period of Performance (PoP) start date? | Undetermined at this time | UNCLASSIFIED | |||
| 14 | What is the anticipated size and composition of the CORE support team (engineering, security, operations, platform, etc.)? | Undetermined. Seeking industry input to make determination | UNCLASSIFIED | |||
| 15 | If subcontractors are allowed to support this opportunity under a teaming structure, will all subcontractors be required to meet CMMC Level 2, or will compliance depend on access to CUI and the work breakdown structure defined by the prime? | Cybersecurity Maturity Model Certification (CMMC) Level 2 compliance is required for processing, accessing, storing Controlled Unclassified Information (CUI). | UNCLASSIFIED | |||
| 16 | What are the most significant performance, reliability, or security challenges currently facing CORE? | NGA is seeking enhanced efficiencies and cost savings through the adoption of industry best practices to modernize platform components and operations. | UNCLASSIFIED | |||
| 17 | Are there specific platform components (CI/CD, container orchestration, monitoring, security scanning, user onboarding, etc.) that are underperforming or in need of modernization? | NGA is seeking enhanced efficiencies and cost savings through the adoption of industry best practices to modernize platform components and operations. | UNCLASSIFIED | |||
| 18 | What metrics does NGA use today to measure CORE success (availability, deployment velocity, security posture, user adoption, etc.)? | NGA measures CORE success using a combination of operational metrics (e.g., uptime, error rates, and resource utilization), general business metrics (e.g., cost and productivity indicators), and DORA metrics (e.g., availability, deployment frequency, lead time for changes, and change failure rate). These provide a holistic view of platform performance and agility. | UNCLASSIFIED | |||
| 19 | What transition-in duration does NGA anticipate, and will incumbent knowledge transfer be required? | Informatioin will be determined and provided if a formal RFP is issued. | UNCLASSIFIED | |||
| 20 | Does NGA have a preferred contract type (e.g., FPIF, CPIF, hybrid) given the evolving nature of CORE? | Seeking industry input to make determination | UNCLASSIFIED | |||
| 21 | How many scrum teams are currently aligned to each CORE product lane (e.g., platform, CI/CD tooling, security, developer experience, observability)? | Currently, NGA aligns 1-2 Scrum teams per CORE product lane. However, we are interested in industry best practices to optimize team structures for highly divergent environments, including multi-security-domain operations. | UNCLASSIFIED | |||
| 22 | What is the typical story point capacity planned during a Release Planning Event (RPE) for CORE, and how many increments are planned annually? | Velocity/capacity is determined by work requirement and final team size | UNCLASSIFIED | |||
| 23 | Are scrum teams aligned to persistent product lanes, or are teams dynamically reassigned based on mission priorities? | Interested in pursuing industry best practices aligned with Agile principles | UNCLASSIFIED | |||
| 24 | Does NGA anticipate a requirement for 24x7 operational support for NGA CORE across all security domains, or is support currently provided during defined mission hours with on-call escalation? | Standard business hours must be covered. Extended hours are dictated by NGA mission needs and/or business continuity in alignment with the SLA; team will be responsive 24x7 | UNCLASSIFIED | |||
| 25 | Are operations today organized as: Dedicated platform SRE/operations teams, or Shared engineering teams with rotational on-call responsibilities? | Standard business hours must be covered. Extended hours are dictated by NGA mission needs and/or business continuity in alignment with the SLA; team will be responsive 24x7 | UNCLASSIFIED | |||
| 26 | Are there specific uptime or incident response SLAs currently enforced for CORE? | Established SLAs will be enforced | UNCLASSIFIED | |||
| 27 | Does NGA prefer a single white paper submission addressing both RFI 1 and RFI 2 within the 12 page limit, or separate white papers for each RFI? | Submit a separate response for each RFI | UNCLASSIFIED | |||
| 28 | When the RFI references demonstrable environments, is NGA looking for currently operational systems, or is architectural depth and implementation experience sufficient at this stage? | NGA seeks demonstrations of currently operational systems in both air-gapped and non-air-gapped environments, at enterprise scale with geographically separated components. | UNCLASSIFIED | |||
| 29 | Does NGA expect to hold technical discussions with respondents after RFI submission to go deeper into specific platform or engineering areas? | Undetermined at this time | UNCLASSIFIED | |||
| 30 | For RFI 1, is NGA expecting respondents to assume responsibility for day to day platform operations at steady state, or primarily augmentation of the existing government contractor team? | Assume day-to-day responsibility for platform operations, development, and modernization | UNCLASSIFIED | |||
| 31 | Should responses assume continuation of the current toolchain as the baseline, or is NGA open to recommendations that materially change or replace existing tools? | Interested in pursuing industry best practices aligned with this type of work. | UNCLASSIFIED | |||
| 32 | With respect to edge and intermittently connected environments, is NGA primarily focused on deployment parity, lifecycle management, or operational support once deployed? | NGA is primarily focused on deployment parity, lifecycle management, and full operational support once deployed | UNCLASSIFIED | |||
| 33 | From an acquisition perspective, is NGA leaning toward labor heavy support, outcome based services, or a hybrid approach for this requirement? | Seeking industry information on best practices to make determination | UNCLASSIFIED | |||
| 34 | Helm/IaC RFI | Page 3 | 2.1 - Planned Acquisition | The RFI specifies a BYOL model for CORE components. Can the Government clarify whether license procurement, renewals, and compliance tracking are expected to remain a Government responsibility, or whether the contractor is expected to provide supporting license management services as part of the deployment approach? | Seeking options utilized in industry and/or similar environments. | UNCLASSIFIED |
| 35 | Helm/IaC and Core Modernization RFI - | Overall | Overall | Based on the structure and content of the provided documents, can NGA clarify whether respondents are expected to submit two RFI responses (Helm/IaC and CORE Modernization), or three distinct RFI responses or one (1) for the Helm/IaC and two (2) for CORE Modernization. | Respondents are expected to submit 2 responses, one per RFI | UNCLASSIFIED |
| 36 | Core Modernization - | Page 1 | 1.2 | The Government encouraged Vendors to respond to one or both RFIs. Would the Government prefer these be combined into one response or 2 separate responses? | Respondents are expected to submit 2 responses, one per RFI | UNCLASSIFIED |
| 37 | Helm/IaC and Core Modernization RFI - | Page 1 | 2.0 Background | To ensure a level playing ground, will the Government please provide Architectural (i.e., OV-1, SV-1, TV-1) and other technical documentation, to include technologies employed today and in the future (as-is, to-be) in a bidder's library and before final RFP? | Bidders library will contain pertinent information to develop an appropriate RFP response. | UNCLASSIFIED |
| 38 | Helm/IaC and Core Modernization RFI - | Page 1 | 2.0 Background | For each domain (IL2/IL4/IL6/TS), will the Government please provide the current cluster count, node footprint, tenancy model, and target-state growth assumptions? Also, how is the edge instance connected/synchronized (if at all) and what are the air-gap constraints for software/container movement? | Two platforms per relevant security domain, one for Development workloads, a second for Operational (production) workloads. Primary tenancy model is multi-tenant with short-term need (within 1-2 years) of also supporting single-purpose, single-tenant, dedicated platform offering for some workloads in addition to the primary multitenant platforms. Edge is network connected but must be sustained as a standalone | UNCLASSIFIED |
| 39 | Helm/IaC and Core Modernization RFI - | Page 1 | 2.0 Background | Will the Government please provide which tool versions/editions are in use per domain (GitLab, runners, OpenShift, Elastic/Grafana, Rocket.Chat) today, and what upgrade cadence/constraints exist (e.g., change windows, ATO triggers)? | NGA CORE implements upgrades during recurring maintenance windows, with AMI refreshes occurring monthly. Software version updates are conducted quarterly or aligned to vendor release schedules, and may be expedited for critical security vulnerabilities. Mission requirements take precedence, requiring flexible adaptation of maintenance schedules. Specific tooling details to be provided in bidders library during RFP process. | |
| UNCLASSIFIED | ||||||
| 40 | Helm/IaC and Core Modernization RFI - | Page 2 | 2.0 Background | Will the Government please provide detail around what IaC standard is authoritative today (Terraform/Ansible/Helm/ArgoCD, etc.), and where is the source-of-truth repo? Are there existing golden modules/blueprints to inherit? | The current IaC standard leverages a variety of configuration management tools for speceific tasks. Current configurations are stored in NGA's GitLab repository. | UNCLASSIFIED |
| 41 | Helm/IaC and Core Modernization RFI - | Page 2 | 2.0 Background | What are Government's requirements for a distributed container registry across domains and at the edge (replication, signing, provenance)? | Interested in pursuing industry best practices aligned with this type of work. | UNCLASSIFIED |
| 42 | Core Modernization RFI - | Page 3 | 2.1 Planned Acquisition | What is the API topology on this program? | Interested in pursuing industry best practices aligned with this type of work. | UNCLASSIFIED |
| 43 | Core Modernization RFI - | Page 3 | 2.1 Planned Acquisition | What are current SLA criteria for incident response of CORE tooling outages? | Standard business hours must be covered. Extended hours are dictated by NGA mission needs and/or business continuity in alignment with the SLA; team will be responsive 24x7 | UNCLASSIFIED |
| 44 | Core Modernization RFI - | Page 4 | 2.1 Planned Acquisition | What ServiceNow integrations are required? | Currently not integrated. Seeking recommendations from industry on best practices | UNCLASSIFIED |
| 45 | Core Modernization RFI - | Page 4 | 2.1 Planned Acquisition | What are the target reference architectures for on-prem/cloud/edge, and what are the constraints on tooling at the edge? | Bidders library will contain pertinent information to develop an appropriate RFP response. | UNCLASSIFIED |
| 46 | Core Modernization RFI - | Page 4 | 2.1 Planned Acquisition | What are the Government's current and future HPC capabilities environments are planned? | To be determined | UNCLASSIFIED |
| 47 | NGA CORE Modernization | Pg. 4 | 2.1 | For RFI 2, please confirm whether the Government is primarily seeking embedded, hands-on engineering support (e.g., platform configuration, CI/CD pipeline development, and code contribution), rather than solely advisory or consultative services. | Hybrid with hands-on and consulting services | UNCLASSIFIED |
| 48 | NGA CORE Modernization | Pg. 4 | 2.1 | Within the scope of RFI 2, please confirm whether the Government’s primary interest is focused on platform-level DevSecOps and Kubernetes engineering (e.g., cluster architecture, multi-tenancy, CI/CD enablement), as opposed to application-specific development support. | Platform-level DSO and Kubernetes | UNCLASSIFIED |
| 49 | NGA CORE Modernization | Pg. 4 | 2.1 | Should respondents to RFI 2 assume that engineering support will be required across multiple security domains, including TS/SCI environments, with an expectation of parity in tooling and processes across domains? | Yes | UNCLASSIFIED |
| 50 | NGA CORE Modernization | Pg. 4 | 2.1 | For purposes of responding to RFI 2, please confirm whether Red Hat OpenShift represents the current enterprise Kubernetes baseline, or whether experience across multiple Kubernetes distributions is of interest, provided they align with enterprise and security standards. | Yes, RH OpenShift represents the current baseline. | UNCLASSIFIED |
| 51 | NGA CORE Modernization | Pg. 4 | 2.1 | Does the Government anticipate that the capabilities described in RFI 2 may be pursued separately from RFI 1 in future procurements (e.g., via distinct task orders or acquisition vehicles aligned specifically to engineering support services)? | Interested in pursuing industry best practices aligned with this type of work. | UNCLASSIFIED |
| 52 | NGA CORE Modernization | Pg. 8 | 4.2 | For purposes of formatting clarity, may charts, tables, or diagrams within the white paper use reduced font sizes (e.g., 10- or 11-point), provided that all narrative text remains compliant with the stated 12-point font requirement? | Font size should be 12 pt. | UNCLASSIFIED |
| 53 | NGA CORE Modernization | What is the relationship between this Helm/IaC implementation effort and the broader CORE Modernization initiative? Will these be separate contracts or integrated? | Subject to Helm/IaC implementation. Undetermined if integrated or segregated | UNCLASSIFIED | ||
| 54 | NGA CORE Modernization | What is the anticipated timeline for Helm/IaC implementation? Should this be completed before, during, or after the CORE platform modernization? | Helm/IaC implementation should be integral to a day 0 implementation strategy. | UNCLASSIFIED | ||
| 55 | NGA CORE Modernization | What level of ongoing support is expected after initial implementation? Should the contractor provide training, runbooks, and knowledge transfer to NGA teams? | Sustained operational support | UNCLASSIFIED | ||
| 56 | NGA CORE Modernization | What is the current state of CORE deployment across IL2, IL4, IL6, and TS/SCI environments? Are all security domains equally mature, or are some prioritized for modernization? | CORE is deployed across all security domains (IL2, 4, 6 and TS/SCI) and are equally mature. | UNCLASSIFIED | ||
| 57 | NGA CORE Modernization | How many Key Components (KCs) currently use CORE, and what is the distribution of workloads across them? | All Key Components are represented. Distribution is variable based on specific business and mission needs | UNCLASSIFIED | ||
| 58 | NGA CORE Modernization | What are the most significant pain points with the current CORE implementation that this modernization must address? | The most significant pain points with the current CORE implementation include limited flexibility and on-demand scaling of infrastructure, hindering rapid adaptation to evolving business and mission needs. NGA seeks industry best practices to enhance efficiency and address these challenges through modernization. | UNCLASSIFIED | ||
| 59 | NGA CORE Modernization | What is NGA's strategy for multi-cluster architecture and orchestration? Should the solution support multiple clusters per security domain for tenant isolation, workload segmentation, or geographic distribution? | Two platforms per relevant security domain, one for Development workloads, a second for Operational (production) workloads. Primary tenancy model is multi-tenant with short-term need (within 1-2 years) of also supporting single-purpose, single-tenant, dedicated platform offering for some workloads in addition to the primary multitenant platforms. Platform architecture should include extensibilty to support multi-region and multi-cloud if/as requirements and funding dictates. | UNCLASSIFIED | ||
| 60 | NGA CORE Modernization | Is NGA open to multi-cluster orchestration solutions (e.g., Red Hat Advanced Cluster Management, Cluster API, or alternatives) to enable tenant and workload isolation at scale? | Interested in pursuing industry best practices aligned with this type of work. Notionally, it would be optimal to leverage/expand existing capabilities however, open to recommendations | UNCLASSIFIED | ||
| 61 | NGA CORE Modernization | The RFI mentions "single and multi-tenant clusters." What are the specific tenancy requirements? Should the platform support both shared multi-tenant clusters and dedicated single-tenant clusters for different use cases? | Two platforms per relevant security domain, one for Development workloads, a second for Operational (production) workloads. Primary tenancy model is multi-tenant with short-term need (within 1-2 years) of also supporting single-purpose, single-tenant, dedicated platform offering for some workloads in addition to the primary multitenant platforms. | UNCLASSIFIED | ||
| 62 | NGA CORE Modernization | For OCONUS and air-gapped sites, what is the expected cluster topology? Should each site have independent clusters, or should there be a hub-and-spoke model? | No mandated topology. Existing cluster topology is independent clusters per site and security domain. | UNCLASSIFIED | ||
| 63 | NGA CORE Modernization | How are the NGA Key Components (Analysis KC, Dev Core/Enterprise KC, etc.) currently organized from a developer and platform perspective? Is there a unified developer experience across KCs, or does each KC operate independently? | NGA's Key Components are organized in a multi-tenant environment that provides a consistent developer and hosting experience across all KCs. This unified approach ensures standardized tooling and processes, though we seek industry best practices to further optimize developer workflows. | UNCLASSIFIED | ||
| 64 | NGA CORE Modernization | What is NGA's vision for developer self-service capabilities? Should developers be able to provision environments, deploy applications, and manage infrastructure without platform team intervention? | Interested in pursuing industry best practices aligned with this type of work. Ultimately intent is to efficiently maintain an appropriate level of governance either manually or through automation to ensure enterprise accredidation requirements are met | UNCLASSIFIED | ||
| 65 | NGA CORE Modernization | Would NGA benefit from a consolidated Internal Developer Portal (IDP) that provides a unified interface across all Key Components, or should each KC maintain separate developer tooling and portals? | Interested in pursuing industry best practices aligned with this type of work. Open to recommendations. Current environment is multi-tenancy | UNCLASSIFIED | ||
| 66 | NGA CORE Modernization | What developer personas does NGA support (e.g., application developers, data scientists, ML engineers, security engineers), and do they have different platform requirements? | All personas (application developers, data scientists, ML engineers, security engineers) supported. Platform requirements vary greatly across supported platform tenants. Assume all/most standard platform requirements that exist across an enterprise platform environment are applicable. | UNCLASSIFIED | ||
| 67 | NGA CORE Modernization | Is NGA open to alternative Kubernetes distributions beyond Red Hat OpenShift, or is OpenShift a mandatory requirement? If alternatives are acceptable, what criteria would be used to evaluate them? | Interested in pursuing industry best practices aligned with this type of work. Open to recommendations | UNCLASSIFIED | ||
| 68 | NGA CORE Modernization | Are there any Kubernetes distributions or container orchestration platforms that are explicitly prohibited or not allowed? | Distribution must meet IC requirements for this type of work, including ownership requirements | UNCLASSIFIED | ||
| 69 | NGA CORE Modernization | Is NGA interested in AI-powered developer assistance tools (e.g., GitHub Copilot, AWS CodeWhisperer, or alternatives) integrated into the CORE platform to enhance developer productivity? | Yes. AI integration is a shared future, state, vision of NGA and the DoW | UNCLASSIFIED | ||
| 70 | NGA CORE Modernization | Would AI-powered troubleshooting and automated remediation capabilities (e.g., AIOps for platform operations) be valuable for reducing operational burden? | Interested in pursuing industry best practices aligned with this type of work. Open to recommendations | UNCLASSIFIED | ||
| 71 | NGA CORE Modernization | Could AI-assisted code review, security scanning, or compliance checking add value to the DevSecOps pipeline? | Interested in pursuing industry best practices aligned with this type of work. AI integration is part of a future, state, vision of NGA and DoW | UNCLASSIFIED | ||
| 72 | NGA CORE Modernization | Beyond the mentioned Pod Security Standards, NIST 800-53, and DISA STIG, are there additional security frameworks or compliance requirements that must be addressed? | NGA's Risk Management Division establishes comprehensive guidance and requirements for the C-ATO process, to include mandatory onboarding and use of NGA's continuous monitoring dashboard, Galaxy . All software deployed within the NGA environment—whether code, applications, containers, or other executable assets—must receive formal approval through this division. |
Required compliance artifacts vary based on whether the solution is Government Off-The-Shelf (GOTS) or Commercial Off-The-Shelf (COTS). Typical documentation includes results from multiple security assessment tools:
Dynamic Application Security Testing (DAST) Static Application Security Testing (SAST) Dependency vulnerability analysis Grype Container Scanner Advanced Cluster Security scans Software Bill of Materials (SBOM)
| Furthermore, all applications must integrate with NGA's Identity and Access Management (IdAM) solution and configure audit logging to forward events to the Kubernetes platform. These requirements ensure comprehensive security visibility and standardized access control across the enterprise environment. | UNCLASSIFIED | ||||
| 73 | NGA CORE Modernization | What is NGA's approach to container security and vulnerability management? Should the platform include tools like Red Hat Advanced Cluster Security (ACS), Kyverno, or alternatives? | Platform should incorporate tools such as ACS and Kyverno to ensure the platform and all hosted tenant applications comply with DoD/IC/NGA security baselines and standards. | UNCLASSIFIED | |
| 74 | NGA CORE Modernization | How should secrets management be handled across multiple security domains and air-gapped environments? | Interested in pursuing industry/government best practices aligned with this type of work. Must meet current IC requirements | UNCLASSIFIED | |
| 75 | NGA CORE Modernization | What are the expected SLA requirements for platform availability, performance, and incident response across different security domains? | Contracting office response | UNCLASSIFIED | |
| 76 | NGA CORE Modernization | What level of platform automation is expected? Should the platform be fully self-healing, or is some manual intervention acceptable? | Interested in pursuing industry best practices aligned with this type of work. Open to recommendations | UNCLASSIFIED | |
| 77 | NGA CORE Modernization | How should disaster recovery and business continuity be implemented across multiple security domains and geographic locations? | Should follow established NGA BCP standards | UNCLASSIFIED | |
| 78 | NGA CORE Modernization | What cost management and showback/chargeback capabilities does NGA require? Should the platform provide per-KC, per-project, or per-workload cost visibility? | Yes, interested in pursuing industry best practices aligned with this type of work. Notionally, per workload with rollup to KC. | UNCLASSIFIED | |
| 79 | NGA CORE Modernization | What observability and monitoring requirements exist beyond basic platform health? Should the solution include application performance monitoring (APM), distributed tracing, or advanced analytics? | The solution should include continuous system health monitoring, application network performance metrics, user engagement analytics, security vulnerability tracking, and productivity measures through DORA metrics, delivering actionable insights through unified dashboards for improved decision-making. |
Web based system displaying real-time health of CORE systems mostly using Elastic Beats (CPU, memory, disk space), availability (web response codes, latency, uptime), light application performance monitoring (login, system usage, system performance) and analytics using built in API calls to systems when applicable. Extensive use of Grafana for web visualization and real-time data calls, with Elastic Search backend for metrics storage, extensive custom scripting using the Go language, and numerous Grafana plug-ins.
| Industry standard observability capabilities, such as APM, OpenTelemetry, tracing, and advanced analytics should be supported. Observability capabilities should be provided across all CORE tools and platforms, as well as offered extensibly to be leveraged for CORE platform-hosted applications. | UNCLASSIFIED | ||||
| 80 | NGA CORE Helm & Infrastructure as Code RFI | What is the current state of Infrastructure as Code adoption within NGA? Are there existing IaC patterns, tools, or standards that must be followed? | PaaS product line uses a number of configuration tools dictated by team | UNCLASSIFIED | |
| 81 | NGA CORE Helm & Infrastructure as Code RFI | How are configurations currently managed across IL2, IL4, IL6, and TS/SCI environments? Is there a unified approach, or does each domain use different methods? | A standard, rigorous configuration management process should be maintained to ensure maximum parity across all relevant security domains. | UNCLASSIFIED | |
| 82 | NGA CORE Helm & Infrastructure as Code RFI | What existing Helm charts, if any, are already in use? Should the solution incorporate or migrate existing charts? | Helm/IaC implementation should be integral to a day 0 implementation strategy. | UNCLASSIFIED | |
| 83 | NGA CORE Helm & Infrastructure as Code RFI | What is the precise scope of Helm chart deployment? Should Helm be used exclusively for application workloads, or should it also manage platform services? Should the DevSecOps toolchain (GitLab, Nexus, SonarQube, Fortify, Anchore, Grype, Rocket.Chat) be deployed and managed separately from Helm? | Helm charts should be leveraged wherever applicable in support of an automated, streamlined deployment strategy. | UNCLASSIFIED | |
| 84 | NGA CORE Helm & Infrastructure as Code RFI | What is NGA's preferred GitOps approach? Should the solution use ArgoCD, Flux, GitLab Auto DevOps, or another tool? | Interested in pursuing industry best practices aligned with this type of work. GitLab auto DevOps is currently disabled | UNCLASSIFIED | |
| 85 | NGA CORE Helm & Infrastructure as Code RFI | Should Helm charts be stored in the same repositories as application source code, or should they be maintained in separate infrastructure repositories? | Helm charts can be stored in SCM repositories and/or dedicated OCI-compliant container registry. | UNCLASSIFIED | |
| 86 | NGA CORE Helm & Infrastructure as Code RFI | What is the expected chart development workflow? Should developers create their own Helm charts, or should the platform team provide standardized charts as a service? | Both. Developers should be encouraged to leverage Helm charts as applicable for their own deployments. NGA CORE should publish and promote Helm charts as standards for tenant use as applicable. | UNCLASSIFIED | |
| 87 | NGA CORE Helm & Infrastructure as Code RFI | How should applications deployed via Helm connect to shared platform services and common infrastructure? What patterns should be used for service discovery, DNS resolution, and load balancing? | Implementation detail without a singular answer. | UNCLASSIFIED | |
| 88 | NGA CORE Helm & Infrastructure as Code RFI | What networking solutions should be supported? Should the platform include service mesh (Istio, Linkerd), ingress controllers (NGINX, HAProxy, OpenShift Router), or network policy enforcement tools? | NGA CORE platforms should support service mesh, ingress controllers, and network policy enforcement. NGA CORE platforms should provide hosted applications with standard configuration for components suchs as these, while offering maximum flexibility to hosted applications where appropriate and applicable. | UNCLASSIFIED | |
| 89 | NGA CORE Helm & Infrastructure as Code RFI | How should cross-cluster, cross-environment, and cross-security-domain communication be handled for applications deployed via Helm? | Implementation detail without a singular answer. | UNCLASSIFIED | |
| 90 | NGA CORE Helm & Infrastructure as Code RFI | What common services exist across the platform (e.g., shared databases, message queues, caching layers, logging, monitoring) that Helm-deployed applications need to inherit or integrate with? How should these be referenced in Helm charts? | NGA CORE platforms should support shared DBs, messaging queues, caching, logging, and monitoring. NGA CORE platforms should also integrate with all of the most common CSP offerings in these areas, expanding access to more over time based on tenant requirements. | UNCLASSIFIED | |
| 91 | NGA CORE Helm & Infrastructure as Code RFI | How should SSL/TLS certificate management, DNS management, and external connectivity be handled for Helm-deployed applications? | Implementation detail without a singular answer. | UNCLASSIFIED | |
| 92 | NGA CORE Helm & Infrastructure as Code RFI | What IDAM (Identity and Access Management) solution(s) does NGA use? How should applications deployed via Helm integrate with these systems for user authentication and authorization? | NGA CORE platform and pipeline tools leverage both GEOAxIS and KeyCloak for authZ and authN. | UNCLASSIFIED | |
| 93 | NGA CORE Helm & Infrastructure as Code RFI | Should Helm charts include standardized patterns for SSO, SAML, OAuth, or other authentication mechanisms? How should service-to-service authentication be implemented? | A singular strategy is not prescribed. A comprehensive architectural and deployment strategy should address authentication and service-to-service authentication. | UNCLASSIFIED | |
| 94 | NGA CORE Helm & Infrastructure as Code RFI | How should RBAC (Role-Based Access Control) be configured for applications? Should Helm charts include Kubernetes RBAC resources, or should these be managed separately? | CORE platform and pipeline tools should support RBAC. CORE platform should support RBAC and AuthZ/AuthN services for integration with hosted applications. | UNCLASSIFIED | |
| 95 | NGA CORE Helm & Infrastructure as Code RFI | How should sensitive configuration values and secrets be managed within Helm charts across different security domains? What secrets management solution should be used? | A singular strategy is not prescribed. A comprehensive architectural and deployment strategy should address key secrets management and multiple security domains. | UNCLASSIFIED | |
| 96 | NGA CORE Helm & Infrastructure as Code RFI | What cloud service providers must the solution support (AWS, Azure, GCP, Oracle Cloud)? Are there specific cloud services (RDS, S3, managed Kubernetes, etc.) that applications should integrate with? | Currently undetermined. Determination will be made at the larger agency level. Solution must be able to adjust to future state. | UNCLASSIFIED | |
| 97 | NGA CORE Helm & Infrastructure as Code RFI | What is the mix of on-premises data centers versus cloud infrastructure? Should the solution support hybrid cloud deployments and multi-cloud scenarios? | Solution should support multi-cloud, edge, and on-prem | UNCLASSIFIED | |
| 98 | NGA CORE Helm & Infrastructure as Code RFI | What are the underlying infrastructure requirements? Should the solution support bare metal, virtualized environments, or both? What storage solutions (block, object, file) must be integrated? | Interested in pursuing industry best practices aligned with this type of work. Current infrastructure relies on virtual environment | UNCLASSIFIED | |
| 99 | NGA CORE Helm & Infrastructure as Code RFI | Are there specific software or hardware vendor solutions that must be supported or integrated (e.g., NetApp, Pure Storage, F5, Cisco ACI)? | PaaS architecture should provide extensibility to support many/mutiple hardware vendor solutions, while simultaneous abstracting any differences from hosted applications (e.g., through leveraging tools such as crossplane or the like.) | UNCLASSIFIED | |
| 100 | NGA CORE Helm & Infrastructure as Code RFI | How should the CORE platform services themselves be deployed and managed? Should there be a separate bootstrap process independent of Helm, or can the platform achieve self-management using its own tooling? | A singular strategy is not prescribed. A comprehensive architectural and deployment strategy should address management of platform's tooling. | UNCLASSIFIED | |
| 101 | NGA CORE Helm & Infrastructure as Code RFI | What is the chicken-and-egg strategy for initial platform deployment in new environments or security domains? | A singular strategy is not prescribed. A comprehensive architectural and deployment strategy should address deployments across new environments and domains. | UNCLASSIFIED | |
| 102 | NGA CORE Helm & Infrastructure as Code RFI | How should Helm charts and container images be synchronized to air-gapped and OCONUS environments? What is the expected cadence and approval process? | No specific mechanism or methodology is prescribed. Expect cadence to be both frequent regular intervals and ad hoc. | UNCLASSIFIED | |
| 103 | NGA CORE Helm & Infrastructure as Code RFI | How should version drift between connected and air-gapped environments be detected and reconciled? | All software components must maintain version parity across all NGA environments and must be on vendor-supported versions. Versions must meet current security policy. | UNCLASSIFIED | |
| 104 | NGA CORE Helm & Infrastructure as Code RFI | The RFI mentions Semantic Versioning 2.0.0 for Helm charts. Should application versions and Helm chart versions follow the same versioning scheme, or should they be independent? | Implementation detail without a singular answer. | UNCLASSIFIED | |
| 105 | NGA CORE Helm & Infrastructure as Code RFI | What is the expected hot fix process for critical security vulnerabilities? How quickly should patches be developed, tested, and deployed across all environments? | NGA follows DISA patching guidelines: |
Criticals - Within 15 days of patch availability Highs - Within 30 days of patch availability Mediums - Within 90 days of patch availability
| Lows - According to regular maintenance schedule | UNCLASSIFIED | ||||
| 106 | NGA CORE Helm & Infrastructure as Code RFI | Is NGA open to alternative Kubernetes packaging and deployment solutions beyond Helm (e.g., Kustomize, Carvel, Operators)? Should the solution be flexible enough to support multiple deployment patterns? | Solution should support multiple deployment patterns. Interested in pursuing industry best practices aligned with this type of work. Open to recommendations | UNCLASSIFIED |
Attachment J.4 Question and Answer Template &"Courier"&12UNCLASSIFIED//NOFORN//SSI
&"Courier"&12UNCLASSIFIED//NOFORN//SSI
File details come from the government source that posted it. Updated .