RFI Sources Sought Domain and Directory Services.docx

Defense Health Agency (DHA) – Domain and Directory Services Branch (DDSB) Operations and Sustainment Information Technology (IT) Services Sources Sought/Request for Information (RFI) Notice

The Infrastructure and Operations Division (I&O), DDSB of DHA is issuing this Sources Sought RFI as a means of conducting market research to identify resources and capabilities to provide multiple Operations and Sustainment IT services.

DDSB’s mission is to operate and sustain the IT footprint and environments for the medical activities, Other Lines of Business (for example, research), and some Veteran Administration (VA) activities. The medical Joint Active Directory (mJAD) domain is the on-premise Identity and Access Management (IdAM ) system. There is a cloud environment called MED365 for @health.mil applications and services which leverages Identity, Credential, and Access Management (ICAM). There are environments or areas for testing activities. These DHA environments consist of approximately: 3,000 physical and virtual servers, 250 sites located around the world, 250,000 end user devices, and 200,000 users. The customer base supported by DDSB extends to Army, Navy, Air Force medical entities, and mission partners worldwide. A more detailed summary of the requirement is available in the attached Draft Performance Work Statement (PWS) Parts 1 & 5. This activity is being identified as a Capability Service Provider within the Enterprise Information Technology Service (EITS) integrated environment.

INFORMATION REQUESTED

Response should not exceed 10 pages in length, to include diagrams, tables, etc., be in Times New Roman, single spaced, 11-point font, with 1” margins. No exceptions will be granted on formatting requirements. Responses should be in a Microsoft Word compatible file or Scan & Optical Character Recognition (OCR) text readable PDF file emailed to the Points of Contact (POCs) below.

Responses should include a single page cover page, NOT counted in the 10-page limit, with the following information (If submitting a team response, please include the requested information for all companies on the team.):

a) Company Name

b) CAGE Code and Unique Entity ID

c) Address

d) POC

e) POC Phone Number

f) POC email address Business Type (e.g., Large Business, Small Business, Small Disadvantaged Business, etc.) Indicate if you anticipate transitioning to other than a “Small Business” in the next eighteen months.

If the Government has additional questions, the company POC may be contacted with follow-on questions in writing or in a one-on-one session.

EXPERIENCE TEMPLATE

Use the template below to provide requested information for up to three (3) projects, similar to the size, complexity and scope described above, your company/team has performed within the past five (5) years. Please complete one table per project. Projects can be Government or commercial.

Agency/Customer

Project Name

Contract Vehicle and Contract Number

Contract value, or in the case of a Task Order, the Task Order Value (for base and options)

Period of Performance (for base and options)

Place(s) of Performance

Prime or Subcontractor

% of Work Performed

Description of work performed and how it is similar to this scope.

How many end users were supported?

[ ] 1. Developing reports and analytics using PowerBI [ ] 2. Desktop/Endpoint Configuration and End User Experience [ ] 3. Cyber Security Operational Principles [ ] 4. Zero Trust Concepts [ ] 5. Data Encryption Services/Data-at-Rest [ ] 6. Mobile Device Management and Sustainment [ ] 7. Engineering, Architecture, and Design Solutions [ ] 8. Enterprise Configuration Management [ ] 9. Enterprise Windows Server and Desktop Imaging [ ] 10. Software Packaging [ ] 11. Accreditation Support and Documentation [ ] 12. Identity and Access Management [ ] 13. Tier 2/Tier 3 Service/Help Desk [ ] 14. Patch Management [ ] 15. Group Policy Implementation and Management [ ] 16. Enterprise Level Technical Support [ ] 17. Cloud Based Services and Support [ ] 18. Enterprise Subordinate Certificate Authority Infrastructure

ADDITIONAL QUESTIONS

Responses should demonstrate your company’s experience corresponding to the scope included in the Draft PWS Parts 1 & 5 and include responses to the following questions. (If significant subcontracting or teaming is anticipated in order to deliver technical capability, responses should address the administrative and management structure of such arrangements.):

· Engineering and design projects often require creativity and exploration of varying solutions as deliverables and targets are subject to change. Describe how your company would measure progress and contributions.

· Describe your company’s experience in evaluating and incorporating new and emerging technologies into Production environments.

· Describe how your company would provide 24X7X365 support outlined in the Draft PWS Parts 1 & 5.

· Describe your company’s experience with applying the DoD Risk Management Framework (RMF) processes, maintaining cybersecurity with regards to Government Data and Government-related data. Describe your experience with managing a federated system as large as the mJAD. What is your experience with first establishing an Authority to Operate (ATO) and sustaining the ATO the size of the mJAD? What is your history with scanning, reporting, and mitigation on a system of this size and scope in adherence with the ATO? Describe your experiences managing inspections for the ATO by a 3rd party.

· Describe how you would incorporate surge capabilities into this requirement.

· How would your recommended solution be priced (pricing models, not prices)?

· In what ways could DHA employ business reengineering to streamline business processes within the DDSB to gain efficiencies within the branch? Provide any experience your company has had in implementing business reengineering within commercial or federal government health care, DoD, DHA, and/or mission partner environments.

· DHA has its own tenant within Azure called Med365 and is transitioning to Windows 11. Describe the method your company used to transition organizations to DoD365 and Windows 11 within the DoD, DHA, and/or mission partner environments.

· DDSB has recently become responsible for supporting Apple IOS mobile devices. Describe the method your company used for managing Apple mobile devices within the DoD. What best practices would you recommend?

· Compliance and integration is required with the following DoD references, but not limited to: DoD Zero Trust Reference Architecture Version 2.0, Jul 2022, and DoD Zero Trust Strategy dated October 21, 2022. Describe your company’s DoD or commercial experience in implementing, sustaining, and operating Zero trust. What can DDSB expect with sustaining and operating zero trust with relation to Identity Credential and Access Management (ICAM)? What best practices should the branch consider (include sources of information)?

Responses to this Sources Sought must be received by 10 MAY 2024 9:00 AM CDT (local time in San Antonio, Texas). All responses must be attached and emailed to the Contracting Officer, Stephani Preusser (stephani.n.preusser.civ@health.mil), and the Contract Specialists, Mallory Vasquez (mallory.m.vasquez.civ@health.mil) and Dawn Windham (dawn.d.windham.ctr@health.mil). The Subject line of the email must read “(Type Here Business Name) – Response to Sources Sought DHA - Domain and Directory Services Branch (DDSB) Operations and Sustainment”. Emails greater than 20MB cannot be transmitted through the network firewall.

DISCLAIMERS AND IMPORTANT NOTES

THIS NOTICE IS NOT A REQUEST FOR PROPOSALS (RFP). This notice constitutes solely market research as described under FAR 10.002. This notice does not obligate the Government to award a potential contract or otherwise pay for the information provided in response. The Government reserves the right to use results of the communications with industry for any purpose consistent with, and not otherwise prohibited by FAR Part 10.

Submission of any information in response to this market survey is purely voluntary; the Government assumes no financial responsibility for any information or costs incurred. All costs associated with responding to this notice will be solely at the interested party’s expense. Not responding to this notice does not preclude participation in any future RFP, if any is issued.

No proprietary, classified, confidential or sensitive information should be included in your response. Industry responses will be shared with DHA staff for the purpose of market research. The Government reserves the right to use any non-proprietary technical information in any resultant solicitation(s).