Revised RFI - FICAM Infrastructure as a Service 05 18 23 .pdf

REQUEST FOR INFORMATION (RFI)

RFI No. RFI2023-0003

FICAM Infrastructure as a Service

Digital Identity and Security Test Lab

ISSUED BY:

GENERAL SERVICES ADMINISTRATION (GSA)

Office of Internal Acquisition (OIA)

IN SUPPORT OF:

Office of Government-wide Policy (OGP)

Office of Technology Policy (OTP)

Identity Assurance and Trusted Access Division (IATAD)

Posting Date: May 18, 2023

QUESTIONS DUE: MAY 22, 2023, BY 12:00 PM. EST

RESPONSE DUE: MAY 26, 2023, BY 5 PM EST

GENERAL INFORMATION:

THIS IS A SOURCES SOUGHT NOTICE FOR THE PURPOSE OF MARKET RESEARCH ONLY -

NO AWARD WILL BE MADE AS A RESULT OF THIS NOTICE.

Point of Contact:

Bonnie Impastato Contracting Officer Office of Internal Acquisition bonnie.impastato@gsa.gov

(202) 510-3328

INTRODUCTION

THIS IS A REQUEST FOR INFORMATION (RFI) NOTICE FOR MARKET RESEARCH PURPOSES

ONLY. THIS IS NOT A REQUEST FOR QUOTE. THIS IS NOT A SOLICITATION NOR DOES IT

RESTRICT THE GOVERNMENT TO THE ULTIMATE ACQUISITION APPROACH. IN

ACCORDANCE WITH FAR 15.201, RESPONSES TO THIS NOTICE ARE NOT OFFERS AND

CANNOT BE ACCEPTED BY THE GOVERNMENT TO FORM A BINDING CONTRACT. NO

REIMBURSEMENT WILL BE MADE FOR ANY COSTS ASSOCIATED WITH PROVIDING

INFORMATION IN RESPONSE TO THIS RFI OR ANY FOLLOW UP INFORMATION REQUESTS.

FAILURE TO RESPOND WILL NOT IN ANY WAY PREVENT A POTENTIAL OFFEROR FROM

PARTICIPATING IN FUTURE SOLICITATIONS. ALL INFORMATION PROVIDED WILL BE GIVEN

CONSIDERATION AND MAY INFLUENCE THE DEVELOPMENT OF FUTURE SOLICITATION

REQUESTS.

The purpose of this RFI is to identify qualified contractors who can meet the General Services Administration’s (GSA) requirements for Federal Identity Credential and Access Management (FICAM) Infrastructure as a Service Digital Identity and Security Test Lab in the Identity Assurance and Trusted Access Division (IATAD). This lab is used as a sandbox for the following activities:

● Test existing and emerging tools in support of OGP compliance related activities such as Windows Hello for Business, Fast IDentity Online (FIDO) 2.0, and WebAuthN.

● Develop new tools used for compliance monitoring and delivered to commercial, non-profit and government entities as needed

● Develop configuration playbooks and proof of concepts in support of the Federal Executive Councils and the programs supporting the councils’ cross-government work groups and planning activities, including:

○ CIO Council

○ CISO Council,

○ ICAM Sub-Committee chartered working groups, and

○ Federal Public Key Infrastructure Policy Authority chartered working groups

● Develop configuration playbooks for common platforms, cloud options, open source software, government sourced software, or commercially sourced software

● Perform ad-hoc data analysis of public source data, including:

○ Analytics of public key infrastructure (PKI) certificates

○ Certificate Transparency

Any contract that might be awarded based on information received or derived from this market research will be subject to the competitive process. In addition, the purpose of this RFI is to obtain market information on capable sources of supply, industry practices, and input specific to the information provided in Section(s): 2.0 Scope and Objective, 3.0 Task, and 4.0 Capabilities.

Contractors are required to respond with a capability package that is clear, concise, and complete.

The Government is not responsible for any cost incurred by industry in furnishing this information.

All costs associated with responding to this RFI will be solely at the interested vendor's expense.

Not responding to this RFI does not preclude participation in any future Request for Proposal (RFP), if any is issued. Any information submitted by respondents to this RFI is strictly voluntary.

All submissions become Government property and will not be returned.

REQUIREMENT BACKGROUND

Identity Assurance and Trusted Access Division is looking for an infrastructure as a service platform for testing and validation of digital identity products and services. The cloud-based test environment is required to seamlessly integrate cloud services relating to digital identity and technology widely used by agencies. Required services include Azure Active Directory as the primary cloud native directory service with ability to integrate with other cloud-based services for testing purposes as well as testing of FIDO2 alternative authenticators like Windows Hello for Business, Security Keys, and Web Authentication (WebAuthN). Non-cloud native identity and security services that can be integrated within the cloud environment will not be considered.

REQUIREMENT SCOPE & OBJECTIVE

● A secure cloud tenant or subscription with IaaS and PaaS service offerings. The IATAD must be able to directly and immediately provision or release computing resources.

● GSA OGP does not require assistance managing the resources within the account.

● GSA OGP requires consolidated monthly billing, detailed billing and usage data.

● Secure web-based authentication using Azure Active Directory to the cloud environment.

● FedRAMP compliance is optional or as an option to leverage both FedRAMP and non-

FedRAMP boundaries.

● All labor is performed by federal employees or contractors. There are no requirements for labor hours for this RFQ.

● Compute Requirements

○ Must be U.S. based.

○ Complete administrative/root control of computing resources provided

○ Quick deployment of new instances/servers (within 5 minutes)

○ Cloud environment supports multiple operating systems

○ Can be customized easily for custom applications

○ Can have customized security configurations, security groups and network ACLs

○ Easily scale environment through API

○ Easily scale memory, storage and CPU

● Load Balancer Requirements

○ Load balance application traffic across multiple instances

○ Automatically scale load balancing

○ Fault tolerance application support

○ Automatically re-route application traffic if an instance goes down

○ Application load balancing across multiple geographical areas

○ DNS failover

○ Secured traffic between application and infrastructure

○ Easily scaled environment through API

● Static private and public Internet protocol (IP) pools for failover

ANTICIPATED TASKS

Task 1 - Manage infrastructure as a service sandbox subscription / environment with cloud based services.

INTERESTED VENDOR CAPABILITIES

The contractor shall provide a capability statement that is clear, concise and complete describing the firm's competencies and ability to meet the government’s requirements.

PLACE OF PERFORMANCE

The primary place of performance will be the Contractor’s facility. In addition to this location, the Contractor may be required to perform at GSA’s facility, located at 1800 F Street, NW, Washington, D.C. 20405, and additional sites located throughout the Washington, D.C. metropolitan area.

INFORMATION GATHERING FROM INDUSTRY

Please provide detailed responses to the following questions:

1. Provide a narrative of how services described in Sections 3.0 Scope / Task will be performed.

2. Is the entity able to provide a cataloged price list of your products?

3. Which North American Industry Classification System (NAICS) Code do you believe is most appropriate for this requirement?

4. Offerors are required to comply with Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act (NDAA) Part B requirement(s). Does the entity certify in the System for Award Management SAM that it is compliant with Section 889 Part B?

5. Can your company independently provide the entire range of requirements? If not, which requirements cannot be met and describe teaming arrangements to meet all the requirements? Describe which tasks will be provided by each team in terms of percentage of work.

6. What is your length of experience?

BUSINESS INFORMATION

a) Name of company:

b) URL of company:

c) DUNS number:

d) CAGE Code, if applicable:

e) NAICS (North American Industry Classification System) Codes:

f) POC, Telephone Number(s), Address, and e-mail address:

g) Business size:

h) Any business socio-economic categories applicable:

Note: Some firms may have more than one socio-economic category, identify all that apply such as: Small Business: Small Disadvantaged Business concerns (SDB) including, 8(a) business development participants, which includes: Alaskan Native Corporations, Indian-Owned concerns: and Native Hawaiian Organization-Owned:

HUBZone (HZ), Veteran-Owned Small Business concerns (VOSB): Service-Disabled Veteran-Owned Small Business concerns (SDVOSB): Economically Disadvantaged Women-Owned Small Business (EDWOSB) concerns: and Women-Owned Small Business (WOSB) concerns eligible under the WOSB Program.

i) URL of product(s):

j) Federal contract vehicle or vehicles under which the solution can be provided, including contract number:

k) Is the offered solution priced in your GSA Schedule contract?

l) Registered in the System for Award Management (SAM) (Yes/No):

RFI RESPONSE INSTRUCTIONS:

Interested Parties are encouraged to provide a capabilities statement on how they would provide GSA with the services noted herein.

NOTE: The capability package must be clear, concise, and complete. GSA is under no obligation to provide feedback to the company, or to contact the company for clarification of any information submitted in response to this RFI.

RESPONSE STRUCTURE:

The Respondent shall structure and number their response sections as prescribed below and address all items/topics listed:

RESPONSE INFORMATION:

The Government is not obligated to and will not pay for any information received from the potential sources as a result of this RFI. It is requested that interested businesses submit to GSA’s Contracting Officer a brief capabilities package (single spaced, one sided, letter size, Times Roman, 12-point font minimum, with 1 [one] inch margins, in “.doc”, “.docx”, or “.pdf” file formats.

No Classified information will be included anywhere in your responses.

All proprietary information must be clearly marked in accordance with the instructions set forth below in “Marking Requirements.” Any information submitted in response to the RFI may be disclosed to GSA and other Government personnel. All information marked as proprietary information will be safeguarded by GSA to prevent unauthorized disclosures to non-government personnel and entities in accordance with applicable laws and regulations. The GSA reserves the right to challenge proprietary information markings.

Notwithstanding any proprietary information marking, GSA shall be able to include any information provided by interested sources, in a subsequent Request for Quote (RFQ), should one be issued.

Marking Requirements: The header and footer of each page containing interested source proprietary information shall be marked with the legend “PROPRIETARY INFORMATION.”

Further, the particular paragraph(s) section(s), etc. containing the actual proprietary information shall be clearly high-lighted or otherwise marked by the Respondent.

This is an RFI. No solicitation exists; therefore, do not request a copy of the solicitation. If a solicitation is released, it will be synopsized in Sam.gov or GSA Ebuy. It is the potential offeror’s responsibility to monitor the release of any solicitation. The information provided in this RFI is subject to change and is not binding on the Government. GSA has not made a commitment to procure any of the items discussed, and release of this RFI should not be construed as a commitment or as authorization to incur cost for which reimbursement would be required or sought. All submissions become Government property and will not be returned.

QUESTIONS: Questions regarding this RFI shall be submitted to the Contracting Officer, Bonnie Impastato, bonnie.impastato@gsa.gov with the email subject header “RFI Questions - FICAM Infrastructure as a Service – (your company name}” by May 22, 2023, by 12:00 PM. EST.

Questions and feedback shall be limited to one (1) page. GSA will provide a consolidated response to all questions by March 23, 2023 by 12:00 PM EST. No questions will be accepted after the specified time and due date to submit questions. Each question submitted must cite the RFI section title/RFI question number for which the question pertains, unless the question is general in nature and not specific to a particular portion(s) of the RFI.

Response Due Date: Responses are due no later than May 26, 2023 at 5:00 PM EST. Submit your responses via email only in “.doc”, “.docx”, or “.pdf” file formats to Bonnie Impastato, Contracting Officer at bonnie.impastato@gsa.gov with the email subject header “RFI Response - FICAM Infrastructure as a Service – (your company name}.” Include: RFI No. company name, email address and phone number of the appropriate representative of your company on the cover page. All responses received after the due date will not be considered. The Government is not obligated to review responses to the RFI received after the deadline specified above. Please be advised that all submissions become Government property and will not be returned. Only electronic submissions in “.doc”, “.docx”, or “.pdf” file formats will be accepted.

Do not include the following in your response:

mailto:bonnie.impastato@gsa.gov mailto:bonnie.impastato@gsa.gov

● Proposals or offers

● Requests to be considered for award or to be notified of a future solicitation

● Requests to be added to a mailing or distribution list

● Questions or comments not related to this RFI

● Classified information

GENERIC COST ESTIMATE

Provide a Rough Order of Magnitude (ROM) estimate to develop, configure and maintain the technical solution based on GSA’s requirements. What are the anticipated “best guess” annual cost and other costs/fees? Please base your cost estimate(s) on any assumptions based on the requirements as listed in this document. Please provide for a base plus four years.

PUBLIC RECORDS AND REQUESTS FOR CONFIDENTIALITY:

Any document submitted that contains confidential information must be watermarked as containing confidential information, and each page upon which confidential information appears must be marked as containing confidential information. The confidential information must be clearly identifiable to the reader wherever it appears.

FINAL COMMENTS

This is an opportunity to provide meaningful feedback in the early stages of the market research and the pre-solicitation “need definition” for GSA’s marketing automation tool solution. Your thoughtful participation is encouraged. It is an opportunity for good corporate citizenship and to show your best interest in a more effective and efficient government. As a major conduit to many of your goods and services for federal agencies, states, and local/tribal governments, GSA’s improvement can also be realized in an improved marketplace for your company.