RFI - FY27 NOAA MDM.pdf

Mobile Device Management (MDM) Hosted Service SaaS Request for Information (RFI)

A. Introduction and Purpose

The National Oceanic and Atmospheric Administration (NOAA) is seeking information from qualified vendors regarding the procurement of licenses for a Commercial-off-the-Shelf (COTS) Software as a Service (SaaS) Mobile Device Management (MDM) cloud hosted service.

The goal is to manage multiple Operating System (OS) platforms and devices across the NOAA enterprise. Interested parties are invited to respond to this Request for Information (RFI) and will be referred to as “Respondents.”

B. Background

The NOAA Office of the Chief Information Officer (OCIO) oversees NOAA’s IT resources and services, which support a wide range of critical environmental and economic functions. NOAA is committed to improving IT services while reducing costs through the Federal Shared Services Model.

C. Scope and Objectives

NOAA requires information regarding an end-to-end SaaS solution to manage multiple Operating System (OS) platforms across the enterprise.

a. License Volume: Approximately 3,500 core MDM licenses.

b. Optional Volume: Information on an option for an equal amount (3,500) of

Mobile Threat Management (MTM) licenses.

c. Core Platforms: Management of Apple (iOS/iPadOS/macOS), Google

(Android/ChromeOS), and Microsoft (Windows 10/11).

d. Security Standard: The solution must be FedRAMP Authorized and maintain a

FISMA Authority to Operate (ATO).

e. Contract Structure: Anticipated Firm-Fixed-Price (FFP) Task Order with a Base

Year plus four (4) Option Years.

f. Provide or option for a Technical Account Manager (Consultant On Demand)

D. Minimum Technical Requirements

a. Tier 0 Support Portal (High Priority): A Section 508-compliant end-user portal allowing users to independently perform basic actions like password resets, device management controls and remote device wipes without support staff intervention, even when not in physical possession of the device. The portal's web interface must authenticate using NOAA's Single

Sign-On (SSO).

i. Capability to integrate with Google Workspace Enterprise and ForgeRock

OpenAM/OpenDJ for LDAP and SSO.

b. Automated enforcement of DISA Security Technical Implementation Guides

(STIGs).

c. Availability of Subject Matter Experts (SMEs) to provide Consultant on Demand

Tier 3 support for a federal-led migration.

d. FedRAMP Authorization and FISMA ATO status/pathway

e. Section 508 compliance across end-user and administrator portals

f. Ability to run and export reports based on admin specified criteria

g. Zero-Day Support for the new OS version of iOS/iPadOS and Android.

h. Support Over-the-Air (OTA) Enrollment

i. Remote Actions: Over-the-air remote lock, passcode reset, device locate (GPS tracking where permitted by policy), and selective wipe (removing only corporate data/containers) or full enterprise wipe.

E. Additional Questions

Please provide concise responses to the following:

a. Tier 0 and Self-Service Capabilities

i. Functionality: Describe your solution’s Tier 0 end-user portal. Does it natively support remote device wiping and passcode resets by the end-user?

ii. Accessibility and Identity: Confirm if the portal is Section 508 compliant and describe its ability to authenticate via NOAA’s Single Sign-On (SSO).

iii. Automation: Does your solution provide robust APIs that allow these Tier 0 functions to be integrated into external agency dashboards or automated workflows?

b. Technical and Security Capabilities

i. Threat Management (MTM): Describe your MTM capabilities, specifically regarding malware detection, jailbreak/root detection, and automated remediation actions.

ii. Data Segregation: How does your solution isolate government data from personal data on BYOD devices via containerization ?

iii. Describe the automated remediation capabilities of your solution for non-compliant devices. Does the platform support automated, policy-driven factory resets (full wipes) for devices that fail to meet specific security or STIG-based criteria?

iv. Do you support encrypted containers for enterprise mail, calendar, contacts, browser, documents, and custom apps?

c. General Questions

i. Do you offer option periods to continue services beyond a 1-year base period?

ii. On what government contract vehicles do you offer this service (e.g.

GSA MAS, NASA SEWP V, etc.)?

iii. What additional operating systems do you support, outside of iOS and

Android, as part of your SaaS offering (e.g., ChromeOS, Windows)?

iv. Are there preconfigured approved and denied lists for iOS and Android applications?

1. If so, how are these lists categorized within your SaaS platform?

2. How do you handle updates to these lists in your SaaS solution?

v. Can you provide details on your app categorization process for both iOS and Android platforms as part of your service?

vi. Does your solution provide support for Apple Declarative Device Management (DDM) & Apple Business Manager (ABM)

vii. Does your solution provide support for YubiKey/Security Key for phishing resistant MFA

viii. Does your solution have Built-in remote mobile device support?

ix. Does your solution provide cloud based device backup/restore options that are FedRamp certified?

1. What FedRamp options are available for backing up SMS?

2. What FedRamp options are available for backing up devices?

x. AI controls/policies as it relates to iOS and Android

d. Migration and Consultancy

i. SME Support: Describe how your Tier 3 Consultants on Demand support a federal-led team during large-scale transitions.

1. Please describe the availability of your technical consultants and subject matter experts. Does your organization provide "Consultant on Demand" support during standard Eastern Time (ET) business hours?

ii. Transition Efficiency: Given the requirement to factory reset and re-enroll approximately 3,500 devices, describe any automated tools or enrollment programs your solution leverages to minimize downtime.

iii. What is the estimated timeline for complete transition?

iv. Strategies for minimizing disruption during the transition?

v. Migration from IBM MaaS360: Given that our current environment relies on IBM MaaS360, please describe specific tools, automated workflows, or methodologies your solution leverages to facilitate a migration from this platform. Address how your approach specifically mitigates the risk of downtime, device re-enrollment complexity, and potential service disruption.

F. Submission Instructions Respondents

Responses should be submitted in PDF format to the contacts listed below and should not exceed five (5) pages (excluding a cover page and table of contents). The Government may contact respondents to obtain additional information, clarification and/or market research to fully understand a company's response. Please include in your response the following:

a. Company Profile: Name, UEI, CAGE Code, business size status, and Point of Contact.

b. Capabilities Statement: Respondents must address the minimum requirements detailed in Section D and Section E questions.

c. Pricing Model: Provide preliminary pricing models or estimates for the Base plus 4 year structure. To assist with building an Independent Government Cost Estimate (IGCE), please break down these estimates by:

i. Core MDM licenses

ii. Optional MTM licenses

iii. Hourly consultancy rates

G. Response Due Date

Responses are due by: 2:00 PM ET, October 5, 2026

H. Confidentiality

All information submitted in response to this RFI will be treated as informational and confidential market research, and will not be disclosed to any third parties without prior consent.

I. Contact Information

For questions or clarifications regarding this RFI, please contact:

Daniel Ok Contract Specialist daniel.ok@noaa.gov

Paul Batrony Contracting Officer paul.batrony@noaa.gov mailto:daniel.ok@noaa.gov mailto:paul.batrony@noaa.gov