RFI Virtualization Enterprise Software Solutions .docx

RFI Virtualization Enterprise Software Solutions For: Virtualization Enterprise Software Solutions for the Department of War (DoW) RFI Number: 842674441 Issuing Agency: Defense Information Systems Agency (DISA) Date of Issuance: 4/24/26 Response Due Date: 15 Days Post-Release

1.0 INTRODUCTION & PURPOSE

The Defense Information Systems Agency (DISA), on behalf of the Department of War (DoW), is issuing this Request for Information (RFI) to conduct market research. The purpose of this RFI is to identify qualified sources capable of providing a standardized, enterprise-scalable virtualization software solution, to include all associated software sustainment, upgrades, and technical support services under an enterprise-wide agreement within the next 12 months. The objective is to establish a centralized, efficient, and cost-effective procurement vehicle.

The Government intends to establish a Blanket Purchase Agreement (BPA) with a five-year ordering period (one-year base period and four one-year options) to procure products and services for the DoW, including 4th Estate Agencies, Combatant Commands (COCOMs), and Military Departments (MILDEPs), against the GSA Multiple Award Schedule (MAS) Information Technology category.

This is an RFI only. This is not a solicitation or Request for Quote (RFQ) and does not commit the Government to award a contract. The Government will not pay for any information or administrative costs incurred in response to this RFI. All costs associated with responding to this RFI are solely at the interested party's expense.

2.0 BACKGROUND AND CURRENT VIRTUALIZATION ENVIRONMENT

The Department of War (DoW) is committed to leveraging advanced technologies to enhance the security and effectiveness of its IT operations. DISA is collaborating with DoW components to create an enterprise-wide solution for procuring commercial-off-the-shelf (COTS) virtualization software. This initiative aims to consolidate numerous existing contracts and streamline vendor management for critical Virtualization products supporting server virtualization, cybersecurity, endpoint protection, and network management across the DoW's IT infrastructure.

The DoW’s virtualization environment is a critical component of its global IT infrastructure, providing enterprise compute capabilities supporting approximately 700,000 cores. This environment is characterized by its significant scale, geographic diversity, and complex security requirements, with resources deployed across CONUS and OCONUS locations. These include DoW data centers, enterprise computing facilities, and tactical/forward-deployed environments, spanning multiple security domains and classification levels. All solutions must align with DoW enterprise architecture, cybersecurity (e.g., STIGs, Impact Levels), and lifecycle sustainment requirements.

The platform primarily supports the following use cases:

1. Mission Application Hosting: Serving as the foundation for critical warfighting and business systems.

2. Development & Testing: Providing sandboxed environments for developing and testing new capabilities.

3. End-User Computing (EUC): Supporting Virtual Desktop Infrastructure (VDI) and other virtualized user-facing services.

3.0 SCOPE OF REQUIREMENTS

The Government requires a comprehensive virtualization portfolio to support an estimated 700,000 subscriptions. The proposed solution must be structured to accommodate diverse client needs through offerings like tiered bundles, individual licenses, and hybrid models.

A comprehensive migration plan with a detailed timeline is mandatory. This plan must detail the strategy for transitioning from the current VMware framework to the proposed solution with minimal disruption to mission-critical operations. The plan must also explicitly describe how Artificial Intelligence (AI) will be leveraged to drive automation, reduce administrative overhead, and simplify the deployment, management, and security of the platform.

Furthermore, all proposed capabilities must be designed to integrate with DoW regulations and frameworks, and must minimally address the following core areas:

3.1. Core Platform Capabilities

· Virtualization: Provide a solution that supports both full virtualization and paravirtualization to consolidate applications and establish cloud or VDI environments. It must include live VM migration, storage migration, and seamless import/export functionality, including cross-migration, all managed from a unified administration plane.

· Disaster Recovery & Backup: Deliver robust business continuity through VM-centric snapshots, clones, and replication. The solution must support enterprise-grade backup and recovery via modern APIs (e.g., VSS) and allow for granular recovery (file/folder, full VM, disk-level) across data centers.

· Application & Data Virtualization: Provide capabilities to decouple applications from the underlying OS (application virtualization) and to abstract and integrate disparate data sources without requiring data movement (data virtualization).

· Remote & Automated Management: Enable remote management and monitoring of all infrastructure, including direct remote console access. A comprehensive REST API for programmatic automation and third-party integration is mandatory.

3.2. Management, Analytics, and Security

· Cybersecurity: Deliver advanced threat detection and incident response. This must include Secure Boot, shielded VMs, and native micro-segmentation for application-centric security policies. The system must use AI-driven insights for self-healing security configurations to maintain compliance.

· Asset Management: Provide a centralized dashboard to discover, track, monitor, and manage all physical and virtual IT assets. Crucially, this tool must operate across the DoW's globally distributed and logically partitioned network boundaries, providing a unified view of asset utilization.

· Network Management & Security: Offer solutions for network monitoring, management, and security, including capabilities for SD-WAN, web/email security, and virtual networking.

· Logging, Analytics, and Reporting:

· Log Management: Ingest syslog and custom logs from all platform components (hypervisors, hosts) and retain them for at least one year.

· Analytics & Search: Provide real-time search and analytics to correlate events across all layers (hosts, clusters, VMs, applications, storage).

· Performance & Capacity: Offer real-time and historical analytics (CPU, memory, storage, network) with one-year data retention. The platform must provide forecasting, capacity planning, and "what-if" modeling for workload placement.

· Alerting & Notifications: Support threshold-based and dynamic anomaly detection alerts, with routing to multiple platforms via email, webhooks, and REST API integrations.

3.3. Security, Compliance, and Workforce Enablement

· Security and Compliance

· DoW Impact Level: Products must meet a minimum of DoW Impact Level 5 (IL5) certification, with a clearly defined roadmap to achieve IL6.

· Authentication: The solution must support two-factor authentication via SAML 2.0 or OIDC to ensure integration with the DoW Enterprise Identity, Credential, and Access Management (E-ICAM) solution.

· Training and Continuous Learning

· Foundational Awareness: Introductory training for all technical staff to build a baseline understanding of the new platform's architecture, terminology, and core concepts.

· Deep Technical Training: An intensive, hands-on curriculum for senior engineers and the core migration team covering platform administration, advanced networking, security configuration, and migration-specific tooling.

· Operational Enablement: Role-based training for day-to-day operations teams focused on new Standard Operating Procedures (SOPs), common administrative tasks, and basic troubleshooting.

· Continuous Learning: A strategy for ongoing education, including hands-on labs, to keep staff skills current on new features, performance optimization, and advanced security practices.

4.0 INFORMATION REQUESTED

Interested parties are requested to provide a response that addresses the following areas:

4.1. Company Information

· Company Name, Address, and Website.

· Point of Contact (Name, Title, Email, and Phone Number).

· CAGE Code and Unique Entity ID (UEI).

· Business size and any applicable socioeconomic status.

4.2. Capability Statement

· A detailed response addressing your company’s capabilities for all requirements outlined in Section 3.0. This should include specific responses to the following areas:

· ROI and Value: Describe how your solution provides a clear return on investment (ROI) and long-term value, covering Total Cost of Ownership (TCO), quantifiable ROI metrics, cost effectiveness, enterprise scalability, and strategic modernization value.

· Migration Strategy: Outline a phased migration framework (discovery, pilot, full-scale) from legacy virtualization, addressing DoW's scale and decentralized network. Include plans for risk mitigation, business continuity, and rollback.

· Technology & Commercial Outlook: Provide a 3-5 year technology outlook for virtualization, detailing your product roadmap alignment with trends like sovereign clouds and AI/ML. Describe alternative and predictable consumption pricing models.

· Security & Supply Chain: Detail your corporate security posture, compliance framework (e.g., IL5), and Secure Software Development Lifecycle (SSDLC) practices.

· Global Technical Support: Present a detailed technical support framework for a globally distributed organization, including a sample SLA matrix. Confirm U.S. citizen support and the availability of cleared personnel.

· Program Management: Describe your program management approach, account team structure, and governance model. Provide a sample Executive Dashboard or QBR template.

· Training & Adoption: Outline your continuous adoption plan for establishing a Center of Excellence (CoE) and ensuring long-term user proficiency.

4.3. Contracting and Strategy

· Provide a list of all GSA Schedules or other Government-wide Acquisition Contracts (GWACs) your company holds.

· Provide confirmation of your status as an authorized reseller/distributor for the proposed products, including the OEM Letter of Authorization.

· Provide substantive feedback on the Government's proposed acquisition strategy, commenting on the suitability of Enterprise License Agreements (ELAs) vs. consumption-based models.

· Describe your license management methodology for an enterprise of DoW's scale, providing a case study from a comparable Federal agency.

4.4. Cost - Rough Order of Magnitude (ROM)

· Submit a high-level, non-binding Cost ROM for all requirements, based on an estimated 700,000 subscriptions, detailing varied offerings (tiered, individual, hybrid).

· The ROM should estimate total cost for a one-year base period and four one-year option periods. State your approach to price protection for option years and the pricing plan for integrating additional DoW agencies.

· Submit a separate, non-binding Cost ROM detailing all one-time migration costs (e.g., professional services, training).

5.0 RESPONSE INSTRUCTIONS

· Submission POC: Responses shall be submitted electronically to adam.m.venhaus.civ@mail.mil & christinia.f.rhem.civ@mail.mil.

· Email Subject Line: The subject line must read: “Response to RFI-DISA-VIRTUALIZATION-2026.”

· Format: Responses should be submitted in Microsoft Word, Microsoft Excel, or Adobe PDF formats.

· Page Limit: Responses are limited to 20 pages. The Title Page, Table of Contents, and OEM Letters of Authorization will not count against this limit.

· Response Deadline: Responses are due no later than 10:00 AM CST 5/4/26. Late submissions may not be accepted.

· Follow-On Engagement: After reviewing RFI responses, the Government may schedule follow-up activities. These could include industry days, one-on-one meetings, or requests for product demonstrations.