RFI Cloud Integrator - Cloud Transformation - Build Integrator.pdf

ADMINISTRATIVE OFFICE OF THE U.S. COURTS

Cloud Transformation/ Build Integration Partner

TABLE OF CONTENTS

INTRODUCTION

GLOBAL OBJECTIVES

SECTION 1: PROVIDER BACKGROUND

1.1 Company Name and Contact Details

1.2 Company History

1.3 Use of Subcontracts

1.4 Public Cloud Providers Supported

Amazon Web Service

Google Cloud

Microsoft Azure

Oracle Cloud Infrastructure

1.5 Overall

1.6 Hybrid Service Overview

1.7 Appendix Items Requested

SECTION 2: PROFESSIONAL SERVICES

2.1 Cloud Strategy Advisory

2.2 Cloud Center of Excellence

2.3 Cloud Readiness Assessment

2.4 Public Cloud (IaaS & PaaS) Planning and Design

2.5 Migrating Existing Applications

2.6 Further Professional Services

SECTION 3: MULTI CLOUD SERVICES

3.1 Multi Cloud Strategy

3.2 Multi Cloud Management

3.3 SaaS Management

SECTION 4: CLOUD BUILD INTEGRATION SERVICES

4.1 Establish Cloud Operations Environment

4.2 Integration with enterprise:

4.3 Landing zone automation

4.4 Data Protection

4.5 Other Automation

SECTION 5: ONGOING MANAGED SERVICES

5.1 Overview

5.2 Capabilities

5.3 Cloud Management Platform (CMP) Capability Differences between Cloud Providers 16

5.4 Cloud Management Platform (CMP) Customization

5.5 Cloud Management Platform (CMP) Delivery

5.6 Cloud Management Platform (CMP) API

5.7 Tools for Cloud Financial Management

5.8 Service Management System Integration

INTRODUCTION

The Federal Judiciary's core mission is to interpret and apply the Constitution and federal laws, ensuring the rule of law. It aims to provide equal justice for all, protecting individual rights and liberties. It offers a platform for peaceful dispute resolution between various entities. It acts as a counterbalance to the legislative and executive branches, preventing the misuse of power. The decisions it makes often establish legal precedents for future cases. Additionally, it strives to uphold integrity, fairness, and transparency to maintain public trust.

There are currently a little over 3200 active federal judges, all responsible for adjudication of justice based upon the Constitution of the United States. Each judge is appointed by the President of the United States and confirmed by the Senate, Article III judges for a lifetime term.

While some judges may elect to take on additional responsibilities within their judicial units, all judges are co-equal without hierarchy of any kind.

In 1939, the U.S. Congress established the Administrative Office of the U.S. Courts (AO) under 28 U.S.C. §§ 601-612 to provide administrative support to federal courts. As the administrative organization of the federal judiciary, the AO has a distinct mission of delivering a wide range of services and functions to the Judiciary.

These services include assisting in the development and implementation of judiciary policies and procedures, as well as providing administrative, legal, and Information Technology (IT) services to the courts. The AO is comprised of three departments: the Department of Administrative Services (DAS), the Department of Program Services (DPS), and the Department of Technology Services (DTS), all headed by the AO Director. The AO Director and AO Deputy Director are appointed by the Chief Justice of the United States, in consultation with the Judicial Conference.

The Department of Technology Services is responsible for providing technical services directly supporting the mission of the U.S. Courts. Within the DTS, the Technology Solutions Office (DTS-TSO), overseen by the Chief Technology Officer (CTO) serves as the business owner for this initiative, responsible for collecting and coordinating enterprise-wide business requirements.

The DTS Chief Operating Officer’s Organization (DTS-COO) serves as the business owner for this initiative, responsible for collecting and coordinating enterprise-wide business requirements.

The CTO’s organization is tasked with supporting mission-critical enterprise judiciary systems including but not limited to Identity and Access Management (IdAM), Finance, Human Resources (HR), Case Management, and all related business services and systems effectively and efficiently for the U.S. Courts. These applications support the day-to-day operations of the more than one hundred courts and offices across the United States and its territories.

Since 2010, the DTS has maintained a private “on premises” cloud solution based on VMware that has evolved over many years. The existing solution consists of a portfolio of services in support of complex applications, services, Application Programming Interfaces (APIs,) and interfaces that interact with numerous internal and external systems. This complex environment poses challenges in terms of threat tracing, containment, and eradication.

In 2023, the AO awarded four judiciary-wide cloud blanket purchase agreements (BPAs) directly with four cloud service providers. Those providers were Amazon Web Services (AWS, USCA23B0009), Google Cloud Services (USCA23B0010), Microsoft Azure (USCA23B0011), and Oracle (USCA23B0012). Each BPA has a 10-year ordering period and allows the AO to order cloud services and limited professional services. The AO has completed our use case testing within each CSP environment and now seeks professional and managed services to assist operationalizing public cloud services.

GLOBAL OBJECTIVES

The Federal Judiciary has an ambitious goal to harness cloud technologies to transform operations, fortify cybersecurity, and support the delivery of justice in an era of rapid technological evolution. The vision focuses on leveraging a hybrid cloud approach to deliver scalable, resilient, and secure IT services that align with the Judiciary’s modernization objectives.

By transitioning legacy systems to cloud-native or cloud-ready architectures, the Judiciary moves beyond traditional hosting models to a platform that fosters innovation, agility, and efficiency. Key advancements to include:

Cloud-Native Tools and Automation: Driving operational effectiveness and resource optimization through modern cloud-native technologies.

Enhanced Security Frameworks: Strengthening defenses with a Zero Trust security architecture aligned with NIST standards to combat increasingly sophisticated threats.

Strategic Vendor Partnerships: Accessing innovative capabilities such as real-time threat detection, encryption, and compliance monitoring, which far exceed in-house capabilities.

The Government is seeking input from experienced Public Cloud transformation vendors to determine the feasibility of obtaining services to assist the AO through all phases (planning, design, development, deployment, and operational support) of the Judiciary’s transformation journey. As the Judiciary continues a journey toward modernizing IT infrastructure and systems, the aim is to leverage industry expertise to refine the approach, establish a governance structure, enhance scalability, and ensure security and compliance in the cloud. This RFI serves as an opportunity for the industry to provide insights, capabilities, and best practices that align with the Judiciary’s business and technical objectives. The Government is not looking for any particular proprietary and/or sensitive information but is rather interested in obtaining a high-quality response to answers included in the RFI. If the vendor decides to include any proprietary and/or sensitive information as a part of the response, such information must be properly marked and include a corresponding note on the first page, as provided in the Disclaimer Section of the RFI Notice.

The Judiciary invites responses that detail your organization's experience, solutions, and innovative approaches to all layers of cloud transformation. The provided feedback will play a crucial role in shaping the Judiciary’s future cloud strategy. The Federal Judiciary appreciates your participation and looks forward to your response. Please note that responses do not need to address every question and section in the RFI. Responses may address only specific questions or parts of the RFI. Please view the Notice to this RFI, as published on SAM.gov.

SECTION 1: PROVIDER BACKGROUND

This section is designed to help the AO better understand your company and gain an overview of the services your Company offers in support of public cloud transformation (managed and professional services). Please provide the following information:

1.1 Company Name and Contact Details

Company Name Company Address Location of Company HQ Respondent Name & Role Respondent Contact Details

1.2 Company History

The total number of years the Company has been in business and, if applicable, the number of years under the present business name.

The number of years the Company has been providing the relevant services, as included in this RFI.

Describe your organization’s high-level milestones that demonstrate how your public cloud managed services practice that has evolved over time (e.g., 2017 launch, 2019 AWS partnership status X reached, 2022 acquired xyz). This information will help to better understand your organization’s experience with public cloud managed services.

A brief description of the Company's overall business and objectives, total number of employees, as well as number of employees aligned to each practice. Where headcount covers more than one practice, please indicate.

Specify(?) procurement vehicles your company is currently listed on (i.e., GSA Alliant 2, GSA MAS, NASA SEWP, NITAAC CIO-SP3, etc.)

1.3 Use of Subcontracts

Describe where subcontractors are typically used to provide professional services for public cloud infrastructure.

Describe where subcontractors are typically used to provide managed services for public cloud infrastructure, including their involvement in cloud management tools.

Describe subcontractors tier you currently use to accomplish this work.

Providing a list of the anticipated subcontractors that have done similar work in the past would be highly desirable.

1.4 Public Cloud Providers Supported

Please answer the following questions to assist the AO with a better understanding of the services your organization can provide in support of each identified public cloud service provider:

Amazon Web Service

How many clients do you currently support on Amazon Web Service (AWS)?

How long have you been delivering services using AWS?

Describe your experience supporting government agencies on AWS?

What are the main up to date certifications you have on AWS?

How many AWS certified engineers do you have (distinguish between certifications, and between FTE vs contractor)?

If you have deployed on-premises variants of services for customers, please provide a list of the variants here:_______________________________________________________________

Google Cloud

How many clients do you currently support on Google Cloud?

How long have you been delivering services using Google Cloud?

Describe your experience supporting government agencies on Google Cloud?

What are the main up to date certifications you have on Google Cloud?

How many Google Cloud certified engineers do you have (distinguish between certifications, and between FTE vs contractor)?

If you have deployed on-premises variants of services for customers, list the variants here: ___________________________________________________________________

Microsoft Azure

How many clients do you currently support on Microsoft Azure?

How long have you been delivering services using Microsoft Azure?

Describe your experience supporting government agencies on Microsoft Azure?

What are the main up to date certifications you have for Microsoft Azure?

How many Azure certified engineers do you have (distinguish between certifications, and between FTE vs contractor)?

If you have deployed on-premises variants of services for customers, list the variants here: ___________________________________________________________________

Oracle Cloud Infrastructure

How many clients do you currently support on Oracle Cloud Infrastructure?

How long have you been delivering services using Oracle Cloud?

Describe your experience supporting government agencies on Oracle Cloud?

What are the main up to date certifications you have on Oracle Cloud?

How many Oracle Cloud certified engineers do you have (distinguish between certifications, and between FTE vs contractor)?

If you have deployed on-premises variants of services for customers, list the variants here: ___________________________________________________________________

1.5 Overall

What experience do you have delivering managed or professional services for Gov Clouds?

Describe your experience delivering managed or professional services for Government Cloud platforms. (combining SaaS, PaaS and IaaS with specific functionality for government use cases)

Describe your experience supporting FinOps across a multi-platform environment.

What are the challenges you have seen from your government customers in providing managed or professional services for the areas described in this RFI? We are not looking for specific agencies or individuals, but rather lessons learned, and pain points the AO should account for as we move forward with our cloud requirements.

In prior engagements your organization has had with government agencies for professional services in the cloud, did your organization provide the specific cloud services for the solutions you proposed or worked on or did the agency provide the cloud services through their own or another vehicle for your organization’s use? Cloud services in this question is referring to the specific metered services utilized in one or more of the cloud service providers platforms as part of the professional services engagement.

1.6 Hybrid Service Overview

If you provide hybrid cloud services provide an overview here:

If you can support customer assets in colocation, summarize these services here:

If you offer services to support infrastructure on-premises, provide a brief overview of these services here:__________________________________________________________________

1.7 Appendix Items Requested

A high-level service portfolio summary.

A description of your track record in using public cloud to support requirements.

A summary of government specific experience relevant to our organization within the last 3 years.

A list of reference government agency customers that align to requirements. Please provide URLs to public case studies where available.

SECTION 2: PROFESSIONAL SERVICES

2.1 Cloud Strategy Advisory

Does your Company offer this service? [if not, proceed to the next section] Provide a high-level overview of how your advisory service ensures a customer develops the best strategy to meet their goals.

Explain frameworks/methodologies used, and the areas covered.

List the items contractually delivered within cloud strategy advisory services.

2.2 Cloud Center of Excellence

Do you assist customers with establishing a Cloud Center of Excellence (CCoE) Provide a high-level overview of the services provided in establishing a CCoE.

List the typical deliverables provided when establishing a CCoE.

Identify the information you need from the customer prior to providing a quote for

Cloud Center of Excellence services.

2.3 Cloud Readiness Assessment

Please provide a cloud readiness sample assessment used for similar organizations.

Explain how long a typical readiness assessment will take?

Outline the typical deliverables associated with cloud readiness assessments.

Describe which tools are used, and what level of interaction is needed with the customer for the best results.

Explain how a customer's network connectivity and/or other peripherals for cloud readiness are assessed?

Explain how client's IT operating models are typically redesigned to optimize the public cloud?

Explain how security concerns associated with capturing, storing and processing data associated with readiness assessments can be minimized?

Is identifiable information (e.g., IP addresses) captured during a readiness assessment?

2.4 Public Cloud (IaaS & PaaS) Planning and Design

What services are typically offered in planning and designing an overall public cloud architecture?

How are cloud provider best practices incorporated in these services? Please specify any frameworks or standards that are typically followed.

Indicate which of the following are typically included in planning and design services:

Overall Hub and Spoke design Y / N Landing zone design and automation (e.g., vending) Y / N Overall account structure/hierarchy Y / N Identity and access management (including integration to customer identity systems)

Y / N

Tagging strategy Y / N Cloud network design and integration to customer WAN Y / N DNS services Y / N Monitoring and observability services Y / N Patch management systems Y / N Logging services Y / N Cloud security architecture Y / N Build and deploy solutions (CI/CD) Y / N Configuration management solution Y / N Other provisioning and orchestration Y / N IT resilience (including backup and recovery, high availability and DR) Y / N Compliance and auditing solutions Y / N Ongoing cost management best practices and customer recharging needs Y / N

2.5 Migrating Existing Applications

Explain the typical migration options considered for existing applications (such as rehost, refactor, rewrite)?

How do organizations prioritize applications for migration? Describe a complex client migration plan that has been successful in the past and why?

Describe the toolset typically used to analyze and plan migrations, including application discovery and dependency mapping. What does this toolset NOT do well?

How are security concerns associated with capturing, storing and processing data associated with professional services minimized?

Explain how migrations are planned in conjunction with customer constraints.

How are data migration strategy and associated testing needs typically planned?

Explain how migration testing can be handled.

Explain how risks can be identified and managed in migration planning.

What are typical migration timeline expectations based on application complexity?

Describe the toolset used to govern and manage migration project delivery.

Provide a Responsible, Accountable, Consulted, and Informed (RACI) matrix to demonstrate the split in migration planning responsibilities between your company and the customer.

What are the pain points or issues you see with your government customers when it comes to their migrations to the cloud?

2.6 Further Professional Services

Do you provide the following professional services (Y/N)

Well Architected Reviews Y / N Increasing FinOps / cloud cost management maturity Y / N Cloud provider selection Y / N Workload placement strategy Y / N Cloud-native application design and development Y / N Solution architecture Y / N Containerization of existing solutions Y / N DevOps transformation Y / N Site Reliability Engineering Y / N Workload Optimization (highlight optimization areas, such as cost, security and reliability)

Y / N

Training Y / N Vulnerability and/or penetration testing Y / N

2.7 Further Professional Services

Provide your definition of "application modernization" and provide a brief overview of your company’s capabilities to support application modernization.

To what extent do you rely on partners to assist with application modernization? Please describe the partners you use and explain why.

How do customers most commonly use you to support application modernization, and what are typical business outcomes attributed to the types of application modernization services you provide?

SECTION 3: MULTI CLOUD SERVICES

3.1 Multi Cloud Strategy

Describe services to assist customers in defining a multi cloud strategy.

Describe services to assist customers in designing and implementing a multi cloud technical architecture.

Describe services to help customers choose the optimal cloud in a multi cloud environment for:

a) default workload placement (preferred provider).

b) best fit for workload placement (cloud that natively best supports it).

c) optimization of other policies for cost, security, compliance, and performance considerations.

3.2 Multi Cloud Management

Provide a high-level overview of how your managed services are adapted for customers that use multiple cloud providers. Describe services to assist customers in designing and implementing a multi cloud technical architecture.

Provide more detail information about multi cloud adaptations for each of the following elements:

o Service request management o Incident management o Provisioning, orchestration and automation o Monitoring and analytics o Inventory and classification o Capacity optimization o Cost monitoring o Billing o Backup and recovery o Disaster recovery o Configuration management o Securing the cloud environment

Describe any lessons learned or pain points you have experienced with other government agencies regarding multi-cloud strategies and multi-cloud management.

3.3 SaaS Management

Provide a high-level description of any value-added services that you provide for SaaS solutions (e.g., CASB, security, subscription management, billing, provisioning).

Describe which SaaS solutions your offerings have been designed to accommodate (e.g., Oracle Fusion Cloud ERP, Microsoft 365, Adobe Cloud, Google Workspace, Salesforce, etc.)?

SECTION 4: CLOUD BUILD INTEGRATION SERVICES

4.1 Establish Cloud Operations Environment

Core Cloud Operations Capabilities: Describe your suggested architecture for a comprehensive Cloud Operations environment. Detail how your solution will address the following key operational areas:

o Compute, storage, and database provisioning and management.

o Automated event and incident management, including proactive monitoring and alerting.

o Automation and Infrastructure as Code (IaC) o Asset management and configuration control.

o Comprehensive security management, adhering to NIST 800-53.

o Financial operations, including cost monitoring, optimization, and reporting.

o Disaster recovery and business continuity.

o How the proposed solution will support DevSecOps principals.

Cloud Service Provider (CSP) Utilization: Please address the following:

o Specify the CSP services typically offered to meet the operational capabilities outlined. Provide a detailed rationale of these services, including how they align with government security and compliance requirements.

o For each CSP service identified, describe how it is configured and managed to ensure optimal performance, security, and cost-effectiveness. Relevant Experience and Past Performance: Please address the following:

o Provide detailed descriptions of Cloud Operations environments created, deployed, and maintained for previous government or similarly regulated customer engagements. Include:

o The scale and complexity of the environments.

o The specific technologies and methodologies used.

o Demonstrated experience in meeting government security and compliance requirements.

o Metrics demonstrating up time, and security event response times.

o Any challenges encountered and how they were resolved.

o Provide customer references.

4.2 Integration with enterprise:

Describe how various CSP Identity services are integrated with existing on-prem or cloud-based Identity and access management systems using modern authentication, specifically OIDC, SAML2, etc.

Describe methods for integrating CSP’s Networking including Routing, Network address translation (NAT), Firewalls, DNS and Load Balancing with existing networks built with industry-standard technologies.

Describe how CSP’s Monitoring tools can be integrated with on-premises enterprise monitoring products like Dynatrace and SolarWinds.

Describe how to integrate CSP’s Logging/SIEM services with the on-premises SIEM products like CISCO Splunk, Microsoft Sentinel, etc.

4.3 Landing zone automation

Provide a high-level description of automating Landing Zone Architecture deployment in a hub and spoke environment through a continuous integration continuous delivery pipeline.

Describe process for reviewing existing Infrastructure-as-Code developed for Landing Zone Automation and how it would be deployed for use.

Provide detailed description of Landing Zone automation provided or performed for other customer engagements.

4.4 Data Protection

Provide a high-level description of public CSP Data Protection.

Describe how to provide Data Protection based on Availability Zones and Regions for

Virtual Machines, Containers, Serverless applications, SQL and NOSQL databases, structured and unstructured data.

Describe how your organization provides storage requirement forecasts based on a baseline and trending analysis for Data Protection.

Describe how your organization provides storage requirement forecasts based on business application releases, new project requirements, and acquisitions.

Provide information on other Cloud Data Protection services provided or performed for other customer engagements.

4.5 Other Automation

Provide a high-level description of automating the following functions through a continuous integration continuous delivery pipeline.

o Service Catalog o Deployment o Lifecycle management o Governance o Financial operations o Configuration management o Asset management

Describe Cloud Operations automations and service level management that can be integrated with industry-standard IT Service Management (ITSM) tools like ServiceNow.

Provide a high-level description of automating migrations including any pre- or post-migration script-based automation to be injected into the process.

SECTION 5: ONGOING MANAGED SERVICES

5.1 Overview

Provide a high-level overview description of the Cloud Management Platform (CMP) and/or integrated tooling used to deliver services. Include narrative that helps explain which CMP components are provided by third parties (e.g., cost management).

5.2 Capabilities

Please outline the core modules/capabilities/areas of functionality offered by your

Cloud Management Platform (CMP).

5.3 Cloud Management Platform (CMP) Capability Differences between Cloud Providers Provide a short summary response that explains the relative levels of CMP capability for the different cloud providers you support. Per provider, characterize the CMP capability as "none," "basic," "good," or "comprehensive."

5.4 Cloud Management Platform (CMP) Customization

Do you support customers wishing to substitute capabilities of your CMP described above for their own tools? If so, please describe common scenarios that are supported, and what level of managed service is then offered?

5.5 Cloud Management Platform (CMP) Delivery

Under what circumstances (or for which features) does the customer need a license or subscription for full CMP access?

5.6 Cloud Management Platform (CMP) API

Which areas of CMP functionality can customers integrate with using API calls instead of

GUI/Portals?

5.7 Tools for Cloud Financial Management

Please provide additional detail on the tools used to address cost visibility Please provide additional detail on the tools used to address cost optimization.

For which customer role(s) or personas have you optimized the tools described above?

5.8 Service Management System Integration

Which service management system do you use to accept and process incidents and service requests?

Describe the supported use cases and capabilities of integrations you provide between your services and common customer ITSM solutions (by name).

What is your preferred approach to enabling a custom workflow for a customer (e.g., an approval process)?