SIPR VDI RFI.docx

ACC ACQUISITION MANAGEMENT AND INTEGRATION CENTER (AMIC)

REQUEST FOR INFORMATION (RFI) FORM

SECURE INTERNET PROTOCOL ROUTER NETWORK (SIPRNET) VIRTUAL DESKTOP INFRASTRUCTURE (VDI)

1. INSTRUCTIONS

This Request for Information (RFI) is being issued by Air Combat Command (ACC) Acquisition Management and Integration Center (AMIC) as part of its Market Research to identify available sources, capabilities, and receive industry input with regard to Performance Work Statement (PWS) considerations to support SIPR VDI implementation at ACC Main Operating Bases with potential growth to support ACC wide locations.

Responses to this RFI are not offers on which ACC AMIC can issue any contract/order. This RFI has been issued for information and planning purposes only and does not, itself, constitute a Request for Proposal (RFP) or Task Order Proposal Request (TOPR). The Government does not intend to award a contract/order based only on responses to this RFI. Further, the Air Force is not at this time seeking proposals and will not accept unsolicited proposals. Responders are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the interested party’s expense.

If interested, please provide input using the Attachment 1 RFI Response Sheet. Please submit your response to Ms. Jestina Fefegula at jestina.fefegula.3@us.af.mil, Ms. Jasmine Griffith at jasmine.griffith.5@us.af.mil, 1st Lt Cortney Young at cortney.young@us.af.mil, and 1st Lt James Lockatell james.lockatell@us.af.mil no later than 31 July 2020 at 3:00PM EST.

2. DESCRIPTION

The Directorate of Cyberspace and Information Dominance (ACC/A6) is seeking information on how an interested contractor could deliver and manage a large scale Virtual Desktop Infrastructure (VDI) capability. ACC/A6 intends to field this capability using an “as a service” model, where the vendor will develop the system, install and configure it, and then operate the system including monitoring system performance, responding to errors and system failures, and configuring virtual desktop images. ACC currently has VDI in use on hyper converged hardware and VMWare virtualization with thin clients and zero clients. A new system will need to manage and integrate with this existing infrastructure until it is decommissioned. ACC/A6 values and encourages innovation that leverages the newest technologies, practices and services to deliver value, flexibility, resiliency and security (hyper converged HW, cloud, etc.). The system will be installed locally at designated ACC installations and centrally managed from one or two of those installations. The system will be installed at 10 bases and support approximately 5,500 endpoints and concurrent users. The system will be installed on the Air Force’s SIPRNET classified network. There will be no access to the NIPRNET or commercial network, therefore all system access to operate, monitor and manage must be done within the SIPRNET enclave.

3. BACKGROUND

ACC/A6 is conducting market research and analysis on a potential solution to deliver a SIPRNET VDI service for ACC Main Operating Bases (MOBs). Data calls conducted with ACC bases have identified a high-demand for a VDI solution that is provided to them using an “as a service model” so base-level personnel do not have to maintain and support the system. This solution will deliver a VDI system that will be centrally managed and maintained by a vendor workforce and integrate with legacy SIPR VDI. If a solution cannot fully integrate and manage legacy VDI, then the solution should include provisions to provide that capability through other means such as a separate monitoring capability. The objectives of this initiative are listed below.

Objectives:

· Centrally managed VDI system

· Endpoints consisting of thin or zero clients, and software based clients

· Contractor operated and maintained

· Integrates with and manages legacy VDI running on hyperconverged HW and VMWare virtualization

· Reduced cost per endpoint over traditional hardware (thick client) solutions

· Centralized configuration management of the VDI system hardware, middleware and software

· Increased security

· Centralized configuration management of the desktop images

· No remnant classified data when the endpoint is shutdown or the virtual machine is logged off

· Reduce need for safes to store computer hard drives in SIPRNET environments

· Fast recovery of user data

· Reduce replacement cost of desktops

Planned Production/Services Description:

ACC/A6 directorate is planning to acquire a SIPRNET VDI solution that will be delivered using an “as a service” model to the bases. The VDI capability should deliver a standard user desktop environment with a standard suite of software for business productivity, email, web browsing, and Common Access Card (CAC) authentication. The system should utilize thin clients or zero clients with mouse, keyboard, CAC reader, and dual monitor displays. Additionally, ACC/A6 is interested in the ability to deliver a software-based SIPRNet VDI client on a NIPRNet workstation or SIPR client residing in another domain at the same classification level. The Air Force has tested SecureViewTM to deliver a SIPR VDI on a NIPR workstation and may want to offer this service in conjunction with a thin/zero client solution. The system will be centrally managed and operated by a contracted workforce. For this RFI, ACC/A6 defines “as a service” as providing all necessary hardware, middleware, software and personnel to design, develop, configure, install, operate, and maintain the system. This should include expansion and contraction of services over the lifecycle of the system to meet changes in demand for both the users and locations. ACC/A6 will provide the contractors with adequate datacenter space and workspace for the system hardware and personnel.

Delivery Period/Period of Performance:

· ACC/A6 anticipates this being a Fiscal Year 2021 requirement with a period of performance of 5 years with one base year and 4 option years.

Limitations:

· The solution will be hosted on the SIPRNET. There will be no access to the NIPRNet or commercial networks.

· The system should operate on the existing SIPRNET infrastructure such that no network upgrades should be required to operate the system. This includes existing routers, switches, and TACLANEs.

· The vendor must achieve accreditation for the proposed solution through the Risk Management Framework (RMF) process in accordance with Air Force Instruction 17-101, Risk Management Framework (RMF) for Air Force Information Technology (IT). Solution must budget for the associated time and resources.

· Vendor employees implementing solution must possess a minimum security clearance of Secret. Associated costs and resources will be the vendor’s responsibility.

· Vendor employees implementing solution must possess the appropriate Information Assurance (IA) certification(s) in accordance with DoD Directive 8140.01 Cyberspace Workforce Management, and the DoD 8570.01-Manual, Information Assurance Workforce Improvement Program. Associated costs and resources will be the vendor’s responsibility. Associated costs and resources will be the vendor’s responsibility.

· Proper COVID-19 preventive measures (e.g., social distancing, face mask wear, sanitization, etc.) in accordance with local guidance and executive orders.

Security Requirements:

· Shall provide services and solutions to implement and conduct IA operations such as, but not limited to, identity management, identity authentication, threat analyses and certification and accreditation.

· Shall ensure that all the requirements meet the DoD Cyber Security Risk Management Framework (RMF), or the most current standards and guidance that are applicable. This includes Certification and Accreditation (C&A) activities.

· Shall provide applications services that are in compliance with and support DoD, USAF, or IC Public Key Infrastructure (PKI) policies as applicable.

· Shall support activities to make applications PK-enabled (PKE) in order to achieve standardized, PKI-supported capabilities for digital signatures, encryption, identification and authentication.

· Shall provide solutions that meet confidentiality, data integrity, authentication, and non-repudiation requirements as set forth by the DoD and AF IA.

· Solutions shall comply with National Institute for Standards and Technologies (NIST) and Federal Information Processing Standards (FIPS) and applicable IC standards.

Auditing

· VDI performance should be assessed daily.

· Bottlenecks will be diagnosed within two weeks and resolved as soon as possible.

· Detailed reports of top users, applications, dependencies will be reviewed.

· Auditing results will be shared and included in the configuration management plan to optimize user experience.

· Administration

· Shall conduct patch management and firmware updates.

· Shall conduct backup and restore functions.

· Shall use only approved and compliant scanning tools to provide the Enterprise Authorizing Official (AO) a high-quality Continuous Monitoring oversight strategy.

· Shall preform centralized remote management of existing VDI instances using the VMWARE Hypervisor from Langley AFB and Nellis AFB.

· Travel to remote managed sites should be included in proposal.

ATTACHMENT 1 – RFI RESPONSE

1. COMPANY INFORMATION

Company Name and Address:

DUNS Number:

Socio-Economic Status (Small, SDVOSB):

Company Point of Contact:

2. SPIR VDI SUPPORT

A. Would you be interested in responding to this requirement (Y/N)?

B. Do you have experience providing similar services (Y/N)?

C. Please provide a brief description of contracts performing work of similar complexity, scope, qualifications and magnitude. Include your company’s role (i.e. prime, subcontractor, or teaming arrangement), and any other relevant information deemed applicable. – Response limited to 4,000 characters (can be submitted as a separate document)

D. What recommendations do you have for PWS considerations to facilitate successful VDI implementation?

E. What are PWS considerations for how the system should be sustained?

F. What type of end user and administrator training requirements do you anticipate for system use and maintenance?

G. Are you familiar with other contracts providing SIPR VDI solutions to the AF?

H. Is it anticipated that a proposed system will meet requirements for accredited use on SIPR? Are there any there any limiting factors?

I. What is the estimated timeframe to provide a solution to support all ACC Main Operating Bases? Timeframe to support an AF wide solution?

J. How many FTEs would you anticipate to support install and maintenance of solution?

K. What FTE labor categories do you anticipate would be utilized to provide a solution?

L. Are the knowledge, skills, and abilities listed in the description, to include security clearances, reasonable and realistic for the effort?

M. Can you provide a Rough Order of Magnitude (ROM) of the costs may be associated with SIPR VDI implementation and sustainment?

N. Do you anticipate any SIPR domain issues that will limit centralized management of the system?

O. What level of tier support should be provided in the event of an outage?

P. What type of support is typically required for SIPR VDI implementation?

Q. Do you anticipate client images being able to be completely isolated from each other; no user is forced to share “their” system with other users, hence security posture is improved.

R. Do you anticipate that the virtualized desk will be able to be accessed from anywhere in the network?

S. From your experience, does the requirement described above meet the definition of a Commercial service that is offered and sold competitively in substantial quantities in the commercial marketplace?

T. Do you anticipate that this requirement can be defined in a way that would support the use of a Firm Fixed Price Contract? If not what limiting factors are there?