Git License RFI.pdf

DEPARTMENT OF THE AIR FORCE

AIR FORCE LIFE CYCLE MANAGEMENT CENTER (AFLCMC)

CRYPTOLOGIC AND CYBER SYSTEMS DIVISION

JOINT BASE SAN ANTONIO-LACKLAND, TEXAS 78243-7081

REQUEST FOR INFORMATION

UNIFIED PLATFORM INFRASTRUCTURE VALUE STREAM

24 June 2024

1) This Request for Information (RFI) is issued in accordance with the Federal Acquisition

Regulation (FAR) clause 52.215-3 (Request for Information or Solicitation for Planning

Purposes - Oct 1997) and is published to obtain information for use by the Air Force

Lifecycle Management Center (AFLCMC), Cryptologic and Cyber Systems Division

(CCSD), Joint Base San Antonio - Lackland, Texas, for market research and planning purposes only in support of the Development, Security and Operations (DevSecOps)

Infrastructure Value Stream (IVS) for Unified Platform (UP). UP is responsible for developing and sustaining a cloud-based platform that enables cyber operations across the

Department of Defense (DoD).

2) THIS RFI IS NOT A REQUEST FOR PROPOSAL, INVITATION FOR BID, OR AN

ANNOUNCEMENT OF A SOLICITATION; IT IS ONLY INTENDED FOR

INFORMATION OR PLANNING PURPOSES. There is no bid package or solicitation document associated with this announcement. Response to this RFI is strictly voluntary and will not affect any potential offeror’s ability to submit an offer if a solicitation is released.

Any requests for a solicitation package will be disregarded. The Government does not intend to award a contract based on this RFI or otherwise pay for the information solicited.

No entitlement to payment of direct or indirect costs or charges by the Government will arise as a result of preparing submissions in response to this RFI and the Government's use of such information. Submittals will not be returned to the sender. Respondents to this RFI may be asked to provide additional information/details based on their initial submittals.

3) Our organization is currently using GitLab for software version control, continuous integration & delivery (CI/CD), and orchestration of our DevSecOps platform and services.

We are conducting market research seeking alternative products & solutions that can deliver these capabilities and meet the requirements below in paragraph 4. Our objectives for this research are as follows:

a. Identify available products and solutions in the market.

b. Evaluate the features, functionality, and pricing of alternatives.

c. Determine the level of integration and compatibility of each alternative with our

DevSecOps platform, while adhering to DoD security requirements.

d. Scope the level of Government resourcing needed to migrate into a new solution while preserving current operational capabilities.

4) Some of the salient characteristics used to meet our organizational objectives listed in paragraph 3 can be categorized as performance, operational, security, and user requirements. While we have elaborated on a few of these requirements below, is not all inclusive. Here are a few of the characteristics used our environment:

a. Performance

1. 20,000 different project repositories with Role-Based Access Control (RBAC)

2. 100,000 concurrent users

3. 700,000 pipelines

4. 1200 runners

b. Operational

1. Product operates in hardened container capable of being self-hosted on multiple classifications.

2. Product resides in a government-owned container repository or DoD must have source code provided to the government.

3. Tool integration with external scanners through native API or through pipelines.

4. Can employ project-based analytics and Digital Operational Resilience Act

(DORA) metrics as well as aggregate metrics and analytics.

5. Restricts Continuous Integration and Continuous Delivery (CI/CD) deployment jobs via Kubernetes Application Programming Interface (API) using RBAC.

c. Security

1. Federal Information Processing Standard (FIPS)-140-2 compliant.

2. Enables developers to submit rule branches for a merge after validating the changes against specific quality gates such as guardrails, branch review, and automated tests.

3. Compatible OpenID Connect Protocol (OIDC).

4. Compatible Security Assertion Markup Language (SAML) Single Sign-On

(SSO) integration.

5. Capable of Specifying which person, group, or account is allowed to deploy to a given environment, allowing further protection and safety of sensitive environments.

6. Has the ability to specify which branches can deploy to a given environment.

d. User

1. CI/CD for external repo.

2. Environment dashboards.

3. Merge trains.

4. Instance file templates.

5) Our organization will consider both commercial and open-source solutions.

6) As indicated above, this is market research. Contractor responses will be used for planning purposes. Address any comments and/or questions regarding this RFI in writing by e-mail directly to the Contracting Officer, Contracting Officer: Ms. Karin Werner, Email: karin.werner.1@us.af.mil

Program Manager: Mr. Stephen Salinas, Email: stephen.salinas.1@us.af.mil mailto:karin.werner.1@us.af.mil mailto:stephen.salinas.1@us.af.mil

Response due date: Wednesday, 3 July 2024, 8:00 AM CST. Please annotate the subject line of e-mail responses as: “IT Infrastructure License Solution for Unified Platform RFI

#1 Response-‘contract vehicle”. Responses may be emailed to the addresses listed above.

Include your contract vehicle in the subject line of email response.