REQUEST FOR INFORMATION_EA Tool_Final.pdf

REQUEST FOR INFORMATION

Defense Counterintelligence and Security Agency

Enterprise Architecture Tool

1.0 Background

This is a Request for Information (RFI) issued by the Defense Counterintelligence and Security Agency (DCSA) for Market Research purposes only. As permitted by Federal Acquisition Regulation (FAR) 10 “Market Research”, and FAR 15.201(e), responses to this notice are not offers and cannot be accepted by the U.S. Government to form a binding contract. This RFI is issued solely for information and planning purposes; it does not constitute a Request for Proposal (RFP), Request for Quote (RFQ), or a promise to issue an RFP or RFQ. DCSA is not at this time seeking proposals, and as such responders are advised that the Government will not pay any cost incurred in response to this RFI. All costs associated with responding to this RFI will be solely at the responding party’s expense. Not responding to this request does not preclude participation in any future RFP or RFQ. All responses to this request become the property of the Federal Government and will not be returned.

DCSA is an agency of the Department of Defense (DoD), headquartered in Quantico, Virginia, providing security services to the DoD, Military Components, Executive Branch Departments and Agencies, and approximately 10,000 cleared Contractor facilities under the direction, authority and control of the Under Secretary of Defense for Intelligence and Security. The DCSA Office of the Chief Information Officer (OCIO) provides automated information systems and telecommunications in support of this mission.

DCSA is conducting market research to identify potential solutions for modernizing OCIO’s Enterprise Architecture (EA) capability. Specifically, DCSA is seeking information from vendors offering Commercial Off-the-Shelf (COTS) EA platforms and associated services that can provide enhanced collaborative modeling capabilities, improved governance and traceability, seamless integration with existing systems, and robust security compliance with DoD Impact Level 5 (IL5) requirements.

The purpose of this potential requirement is to obtain a solution that enables standardized architecture modeling, system integration, and compliance with federal security requirements. The solution will support strategic planning, business process modeling, system documentation, and collaboration across various stakeholders within the agency. This modernized EA capability is essential for DCSA's broader digital modernization and data strategy, aligning with DoD enterprise architecture policy, zero trust mandates, and mission-driven transformation initiatives.

2.0 Purpose

The purpose of this RFI is to gather information from industry regarding available Enterprise Architecture tools and associated services that can meet DCSA's evolving needs. The information gathered through this RFI will be used to:

• Assess the current state of the EA tool market.

• Identify potential solutions that align with DCSA's requirements and objectives.

• Inform the development of future acquisition strategies and requirements documents.

• Enable a more informed decision-making process regarding the modernization of DCSA's EA capability.

3.0 Functional Requirements and Objectives

3.1 Objectives: DCSA's functional requirements, as detailed below, are designed to directly support the following overarching objectives for the modernized EA capability:

• Enhanced Collaboration: Support collaborative modeling across different teams and directorates, enabling dispersed stakeholders to contribute to and share architectural knowledge.

• Improved Governance and Traceability: Automate governance processes and improve traceability of changes, dependencies, and approvals, ensuring data integrity and compliance with architectural standards.

• Seamless Integration: Provide robust integration capabilities to connect with existing and future data sources, reporting platforms, and security frameworks, streamlining data exchange and reducing manual effort.

• Robust Security: Comply with DoD cloud and IL5 requirements, ensuring the confidentiality, integrity, and availability of sensitive architectural data.

• Scalability and Performance: Offer a secure, scalable, and web-enabled platform that can accommodate DCSA's growing data volumes and user base while maintaining optimal performance.

3.2: Functional Requirements: To achieve these objectives, DCSA is seeking potential solutions that meet the following functional requirements:

1. Modeling Language Support: The solution shall support industry-standard modeling languages, including Unified Modeling Language (UML), Business Process Model and Notation (BPMN), ArchiMate, and Department of Defense Architecture Framework/Unified Architecture Framework (DoDAF/UAF).

2. Modeling Interfaces: The solution shall provide both web-based and desktop client interfaces with consistent functionality.

3. Data Import/Export: The solution shall provide robust import/export functionality, including support for legacy data formats such as XML Metadata Interchange (XMI), Comma-Separated Values (CSV), and Visio, enabling seamless migration and interoperability.

4. Version Control: The solution shall provide a centralized, secure repository for model storage with integrated version control, including change history, branching, and rollback.

5. Integration Capabilities: The solution shall integrate with SQL Server databases and expose/consume Representational State Transfer Application Programming Interfaces (REST APIs) to enable data exchange and automated workflows.

6. Security Compliance: The solution shall be designed to meet DoD IL5, FedRAMP High, and Authorization to Operate (ATO)-readiness standards, ensuring the confidentiality, integrity, and availability of sensitive data.

7. Single Sign-On (SSO): The solution shall support SSO integration with Active Directory (AD) and federal smartcard authentication (Common Access Card (CAC)/ Personal Identity Verification (PIV)).

8. Dashboards and Reporting: The solution shall include customizable dashboards and reporting tools for effective data visualization and analysis.

9. Traceability: The solution shall provide traceability features for linking requirements, architecture, and implementation data.

10. Model Reuse: The solution shall support model reuse, duplication, and extension capabilities to reduce redundancy and increase consistency.

11. Role-Based Access Control (RBAC) and Collaboration: The solution shall include RBAC and collaborative workflows to support concurrent modeling, reviews, and approvals.

12. Scalability and Performance: The solution shall offer a secure, scalable, and web-enabled platform that can accommodate DCSA's growing data volumes and user base while maintaining optimal performance.

13. Operations and Support: The vendor shall provide ongoing operations and support services, including helpdesk support, patching, and monitoring, ensuring the reliability, availability, and performance of the modeling solution.

14. Security Documentation and Compliance Support: The vendor shall support Government efforts to maintain continuous cybersecurity compliance through documentation and technical controls.

15. Licensing: The solution shall be available via a clear, scalable licensing model that supports Government use of the modeling tool.

4.0 Assumptions and Considerations

To assist vendors in preparing their responses, DCSA is providing the following assumptions and considerations related to this potential requirement:

• Existing Models: The Government will provide access to existing repositories for migration planning. Vendors are requested to address how they would preserve model structure, relationships, and fidelity during migration.

• Security Compliance: The proposed solution must meet or exceed DoD IL5 requirements.

Solutions hosted in Cloud One or other FedRAMP High-authorized environments are preferred.

• Deployment Flexibility: The Government is open to Software-as-a-Service (SaaS), on-premises, or hybrid deployment models, provided that all security, access control, and performance requirements are met.

• Stakeholder Participation: A range of stakeholders across DCSA will be involved in this initiative, each with distinct needs and perspectives on the EA capability.

• Migration Testing: Model migration testing may be conducted using sanitized or non-production datasets to validate accuracy and functionality prior to full migration.

• Collaboration and Training: The successful solution will require comprehensive end-user training, readily accessible administrator guides, and ongoing technical support to ensure effective utilization and long-term sustainability.

• Government Points of Contact: The Government will designate a Program Manager and Technical Point of Contact (TPOC) to facilitate access, coordinate demonstrations, and manage communications throughout the contract period.

5.0 Scope of Information Requested

DCSA is interested in obtaining information on the following areas tied to the core functional requirements. Vendors should provide detailed answers to the following questions, referencing the corresponding functional requirement or assumption section where applicable.

5.1 Solution Overview:

• Describe your EA tool and its key features and capabilities.

• Identify the target audience for your solution (e.g., enterprise architects, business analysts, IT professionals).

• Outline the architectural approach of your solution (e.g., cloud-native, on-premise, hybrid).

• Explain how your solution aligns with industry best practices for EA management.

• Please describe your licensing model, including options for user-based, concurrent, or enterprise-wide licensing. How does your model support scalability for an expanding user base over time?

• Does your company offer pricing tiers or Government-specific discounts (i.e., GSA Schedule rates, volume pricing)?

• How does your licensing approach address cloud, on-premises, and hybrid deployments?

5.2 Functional Capabilities:

• What modeling languages does your solution natively support?

• Describe the feature parity between your web-based and desktop clients.

• What specific versions of XMI, CSV, and Visio are supported?

• In addition to listing which formats are supported, please provide details on what architectural content would or would not be preserved through the import/export process

• Describe your solution’s version control capabilities. Does it support branching, merging, and conflict resolution? How is data secured within the repository?

• Describe the dashboard and reporting capabilities. What options exist for customizing dashboards and reports?

• Does your solution have the capabilities to set and monitor data quality metrics, and create reports based on these metrics?

• How does your solution provide traceability of changes, dependencies, and approvals, ensuring data integrity and auditability?

• What existing frameworks does your solution leverage for traceability, and what are the potential limitations for the data that can be tracked?

• How does your solution enable model element reuse, duplication, and extension?

• How does your solution implement RBAC? Can users be assigned multiple roles with varying levels of access? How does your solution facilitate concurrent modeling by multiple users?

• How does your solution facilitate collaboration and feedback from multiple stakeholders and functional groups during the implementation and ongoing use of the tool?

• Please describe the capabilities for collaborative modeling including governance and workflow;

what workflow options does the solution provide?

• What existing frameworks does your solution leverage for traceability, and what are the potential limitations for the data that can be tracked?

5.3 Integration Capabilities:

• Describe your solution’s integration capabilities with SQL Server and REST APIs. What versions of SQL Server are supported?

• Does your solution provide a list of pre-built integrations? Explain how your solution supports data exchange and automated workflows with other systems, including methods for connecting to external cloud providers.

5.4 Security and Compliance:

• What security certifications and authorizations does your solution currently hold (e.g., FedRAMP

High, DoD IL5)?

• Describe your solution’s security architecture and how it aligns with DoD IL5 and FedRAMP

High requirements. Please provide details on relevant certifications and authorizations.

• Describe your solution’s SSO integration capabilities. How does it handle CAC/PIV authentication?

• Detail your approach to continuous monitoring and security updates and how these updates are communicated to end users.

• In addition to local employees, how does your solution ensure the security of remote employees accessing the network?

• Please describe how your solution aligns with DoD Zero Trust architecture principles.

Specifically, how does the solution enforce least-privilege access, continuous monitoring, and identity-based security?

• What capabilities within your solution directly support Zero Trust objectives (i.e., role-based access, granular audit logging, adaptive authentication)?

5.5 Deployment and Maintenance:

• Describe the scalability and performance characteristics of your solution. Explain how your solution handles large volumes of data and concurrent users.

• Describe the available deployment options for your solution and the key considerations for each option (e.g., security, performance, cost).

• Describe your support model, including support hours, response times, and escalation procedures.

• Describe your training and support offerings for end-users and administrators, including available training materials and support channels.

• Describe your approach to migration testing. How will the proposed approach ensure data integrity during and after migration, and what steps are taken to minimize disruption to ongoing operations?

• Please provide examples of current or prior U.S. Government deployments of your solution, including agency name, scope of implementation, and whether the solution achieved an ATO.

• What lessons learned from previous federal, or DoD implementations have influenced your solution’s current architecture and support model?

• Does your solution currently operate in a DoD IL5 (or higher) environment? If so, please describe.

• Describe your approach to supporting the Government Points of Contact.

6.0 Requested Information:

Vendors are requested to respond to this RFI no later than 11:00 AM Eastern on 24 October 2025 by emailing the Contracting Officer, Kelsie Kautz, at kelsie.kautz.civ@mail.mil. Verbal questions will not be accepted. DCSA will respond to questions at its discretion. The Government will not respond to further questions regarding the acquisition strategy or anticipated date of solicitation release.

Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked “Proprietary” will be handled accordingly. Please be advised that all submissions become Government property and will not be returned. All Government and Contractor personnel reviewing RFI responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as described 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

Responses shall include the following information, at a minimum:

1. Entity Information

a) Vendor Name

b) Primary Point of Contact (POC)

c) Address

d) Phone Number

e) Unique Entity Identifier (UEI)

f) DUNS mailto:kelsie.kautz.civ@mail.mil

g) POC email

2. Business Type

Please indicate the socioeconomic business classifications that apply to your company.

3. Contract Vehicles

Provide any contracting vehicles a future DCSA contract award may be placed against.

4. NAICS and PCS Code Recommendations

DCSA will accept recommendations from industry regarding both the NAICS and PSC for this potential effort.

5. Requirements Response

Interested Vendors are requested to provide responses outlining possible technical solutions, capabilities, estimated cost and schedule (if available), and existing contract vehicles (e.g., GSA Schedule contract) where this solution is available. These responses should relate to the requirements described throughout this RFI. Vendors are requested to respond to all questions within Section 5.0, Scope of Information Requested, and reference the corresponding functional requirement or assumption section where applicable for each question.

All correspondence must include the subject line: “DCSA – RFI – EATOOL – (Vendor name)”

6. Formatting

Please provide all responses in a searchable .PDF format. The cover page of the response shall include the company name, Unique Entity Identifier, DUNS Number, address, point of contact including phone number and email address, as well as the business size status of the responding company. There is no specified format for the capabilities statement and technical solution (excluding the information requested in Section 5.0), which shall be limited to no greater than 10 pages.

The responses to the Government’s requested information in Section 5.0 do not count toward the overall 10-page limit. Please include these responses formatted as follows:

• For each item listed in Section 5.0, provide your response directly following the question or prompt. Structure your submission such that each question is immediately followed by your answer.

• Clearly identify each question from Section 5.0 by its original subsection number and title for easy cross-referencing.

• All responses to Section 5.0 should be included within a single, continuous document, separate from the 10-page capabilities statement response, though both should be submitted together as one overall response package.

7.0 Vendor follow-on meetings: DCSA representatives may or may not choose to meet with potential vendors. Such meetings would only be intended to obtain further clarification of potential capability to meet the requirements.

8.0 Summary: This is a RFI only to identify potential solutions pertaining to the subject requirement.

The information provided in the RFI is subject to change and is not binding on the Government. DCSA has not made a commitment to procure any of the items discussed, and release of this RFI should not be construed as such a commitment or as authorization to incur costs for which reimbursement would be required or sought. All submissions become Government property and will not be returned.

Appendix – Acronyms

• AD – Active Directory

• API – Application Programming Interface

• ATO – Authorization to Operate

• BPMN – Business Process Model and Notation

• CAC – Common Access Card

• CSV – Comma-Separated Values

• COTS – Commercial Off-the-Shelf

• DCSA – Defense Counterintelligence and Security Agency

• DoDAF – Department of Defense Architecture Framework

• DoD – Department of Defense

• DUNS – Data Universal Numbering System

• EA – Enterprise Architecture

• FedRAMP – Federal Risk and Authorization Management Program

• IL5 – Impact Level 5 (DoD Cloud Security Requirements Guide)

• OCIO – Office of the Chief Information Officer

• PIV – Personal Identity Verification

• POC – Point of Contact

• PSC – Product Service Code

• RBAC – Role-Based Access Control

• REST – Representational State Transfer (API standard)

• RFI – Request for Information

• RFQ – Request for Quote

• RFP – Request for Proposal

• SaaS – Software as a Service

• SQL – Structured Query Language

• SSO – Single Sign-On

• UAF – Unified Architecture Framework

• UEI – Unique Entity Identifier

• UML – Unified Modeling Language

• Visio – Microsoft Visio (diagramming tool)

• XMI – XML Metadata Interchange

Appendix – Acronyms