Sources Sought Notice_Artificial Intelligence and Machine Learning.pdf

SENSITIVE BUT UNCLASSIFIED

U.S. DEPARTMENT OF STATE

BUREAU OF DIPLOMATIC TECHNOLOGY (DT)

OFFICE OF INFORMATION TECHNOLOGY ACQUISITIONS (ITA)

SOURCES SOUGHT NOTICE

for

ARTIFICIAL INTELLIGENCE / MACHINE LEARNING (AI/ML) SOLUTION

PART 1: SOURCES SOUGHT BACKGROUND AND OBJECTIVES

1.0 PURPOSE

This Sources Sought Notice (SSN) is issued as market research to determine industry’s capabilities to provide a proven commercial-off-the-shelf (COTS) artificial intelligence / machine learning (AI/ML) solution capable of delivering state-of-the-art large language model (LLM) capabilities. The solution must provide a commercially proven base platform with an integrated suite of robust analytical tools and AI/ML capabilities that may be customized to meet specific Department of State (“State”) requirements and use cases. The solution must also provide leading edge capability in large language model (LLM) development to support a range of AI-enhanced workflows able to securely process and analyze government data of various classification levels, meeting federal security requirements such as accreditation at DoD Impact Level 6 (IL6) and having a moderate level or higher FedRamp-authorization for commercial software solution. Additional specific capability requirements are enumerated below.

The Government does not commit to award a contract on the basis of this SSN or reimburse any costs associated with the preparation of responses. This SSN is issued solely for information and planning purposes and does not constitute a solicitation. All information received in response to this SSN that is marked “Proprietary” will be handled accordingly. Responses to the SSN will not be returned. In accordance with FAR 15.201(e), responses to this SSN are not offers and cannot be accepted by the Government to form a binding contract.

Responses to this SSN will assist State in determining the potential level of interest, competition adequacy, and technical capabilities of commercial vendors to provide the required products and/or services. The Government does not guarantee any action beyond this SSN.

2.0 BACKGROUND

State’s mission is to advance the interests of the American people, their safety, and economic prosperity by leading America’s foreign policy through diplomacy, advocacy, and assistance. The mission of the Bureau of Diplomatic Technology (DT) is to rapidly and securely deliver, anytime and anywhere, the knowledge resources and Information Technology (IT) services needed to support the over 300 sites and 275 missions it services worldwide.

DT is seeking input from industry regarding their capability to provide market-leading solutions capable of meeting the full breadth of functional requirements outlined in this SSN. State requires access to a platform that is compliant with current Federal security requirements, is easy to use, flexible, scalable, customizable, and configurable to meet specific State requirements as further detailed below.

3.0 SOURCES SOUGHT OVERVIEW

As further detailed in Section 4, State is seeking to identify capable and interested partners able to provide the products and/or services required to meet the full range of functional capabilities outlined in this SSN. Viable partners shall have demonstrated experience deploying the solutions and delivering the ongoing support required to maintain, expand, and upgrade the solution over time for an organization of similar size, global scope, and mission complexity as State.

Information requested in this SSN includes the following categories:

➢ Company Information (Section 1) – Identification of interested vendors, socio-economic status, and potential acquisition vehicles to inform State’s potential acquisition strategy options.

➢ Capability Assessment Against Functional Requirements (Section 2) – Description of vendor’s proposed technical solution and ability to fully meet all stated functional requirements.

➢ Past Experience (Section 3) – Past project example(s) demonstrating vendor’s experience implementing their proposed solution to address the needs of an organization of similar size, global scope, and mission complexity to State.

4.0 SUBMISSION INSTRUCTIONS:

All written responses should be submitted in Microsoft compatible formats (e.g., Word) or PDF.

Responses must use 12-point font and 1-inch margins, including all text, tables, and graphics. Additional attachments, brochures, or other marketing materials are not requested and will not be considered as part of the response. Response page limit(s) by section are noted below.

• Section 1 – 1 page

• Section 2 – 15 pages

• Section 3 – 5 pages

Please submit all materials to John Warner at WarnerJ1@state.gov by Thursday, Aug 16, 2024 at 4:00pm/ET.

UNDER NO CIRCUMSTANCES SHALL ANY RESPONDENT CONTACT ANY STATE

PERSONNEL REGARDING THIS NOTICE.

mailto:WarnerJ1@state.gov

PART 2: SOURCES SOUGHT REQUESTED INFORMATION

Respondents are asked to provide the information requested below the instructions outlined in Part 1, Section 4.0 above. Submissions not adhering to the submission instructions may be deemed non-responsive and may receive no further consideration.

Section 1 – Company Information

Please provide the following details regarding your organization:

1. Company name

2. Company point of contact (POC) name

3. Company POC phone number

4. Company POC email address

5. Company URL/web address

6. Company Cage Code

7. Company UEI Number

8. Company business size in terms of revenue and number of employees

9. Company Federal socioeconomic classification(s), if any, based on North American Industry Classification (NAICS) Code that applies to the solution.

10. List GSA schedule, Government wide acquisition contracts (GWACs), or other Federal IDIQs or contracts the Respondent holds that are relevant to this requirement and accessible by State, including corresponding schedule number or contract number.

Section 2 – Functional Requirements Assessment

State’s functional requirements for the solution are outlined below. Respondents are asked to provide a structured and annotated response that clearly maps the description of the proposed solution’s capabilities to the numbered requirements below. The Respondent’s narrative should provide sufficient details regarding the solution’s technical capabilities to demonstrate that the solution is capable of fully satisfying each stated requirement. Responses that do not clearly map to the information stated in the listed requirements below, or are otherwise unclear, may be deemed non-responsive and may not receive further consideration.

2.1 Mandatory Qualifications

The following qualifications and capabilities are mandatory requirements for any potential solution addressing the needs outlined in this notice. Respondents should assess these “Go/No-Go” requirements carefully, as solutions unable to meet these requirements will not be considered as viable options by State and will not receive further consideration:

a. Solution must be based on a commercially proven COTS software platform

– State is not seeking custom-developed solutions that have not yet been successfully deployed at other Federal agencies similar in size and scope to State.

b. Solution must possess significant out-of-the-box functionality enabling it to be deployable on day one of the project, while also supporting custom configuration within expedited timelines.

c. Solution must be built as a single, vertically integrated platform with end-to-end solutions leveraging seamless integration across capabilities and tool sets.

d. Solution must incorporate comprehensive in-house professional and configuration services, supported by a cohesive and specialized team of experts.

e. Solution must be accredited at DoD Impact Level 6 (IL6), as defined in the U.S. Department of Defense (DoD) Cloud Computing Security Requirements Guide (CC SRG), in alignment with NIST 800-53.

f. Solution must have moderate level or higher FedRAMP-authorization for a commercial software solution.

g. Solution must be capable of encrypting data, both at rest and in transit, via mechanisms compliant with Federal Information Processing Standard (FIPS) Publication 140-2.

h. Solution must be able to comply with State’s Cybersecurity Supply Chain Risk Management (C-SCRM) policy.

2.2 Artificial Intelligence / Machine Learning

State is interested in a SaaS platform with a robust and comprehensive suite of analytical tools with configurable Artificial Intelligence / Machine Learning (AI/ML) capabilities.

a. Solution should offer state-of-the-art AI capabilities which provide highly secure, AI-supported data automation.

b. Solution’s AI capabilities should enable technical and non-technical users to use large language models (LLMs) to better consume and configure workflows without knowing standard programming languages such as SQL or Python.

c. Solution’s capabilities should include a combination of engineering, tool chaining, robust security, and a unified object model to ensure secure automation can be applied effectively across daily tasks.

d. Solution should enable deployment of multiple LLMs across various workstreams and even individual tasks, all while maintaining robust security features.

e. Solution must have the ability to seamlessly upload, preprocess (including Optical Character Recognition (OCR), chunking, embedding), and manage documents, translating them into usable and searchable content for AI applications.

f. Solution must leverage Generative AI features (e.g., categorization, summarization, generation of new content, and semantic search) in processing source content, generate new content by utilizing previously uploaded content and documentation, and integrate with a high volume of connection points and process numerous data sources of differing types and formats.

g. Solution must support robust, secure translation capabilities, including the ability to upload and translate content in languages other than English. It should provide an interactive interface for immediate foreign language translations and ensure results are loaded within a few seconds under normal network conditions.

2.3 Data Analytics and Management

Along with the AI/ML capabilities listed above in Section 2.2, State requires a data management and analytics capability to better support data-driven insights and decision making across various Bureaus and Offices. Please describe your solution’s ability to meet the following requirements and provide information on any additional core capabilities provided by your solution that State should be aware of relative to other market alternatives for AI/ML, data analytics, and data management capabilities.

a. Solution must enable State to efficiently manage enrollment by integrating essential organizational data to support workflows designed by system engineers and internal analysts.

b. Solution must be capable of establishing data connection agents in State’s current cloud deployments to streamline operations and enable self-service analytics, integrating key data systems such as ServiceNow, Okta, and SharePoint.

c. Solution must be capable of bringing in, cleaning, and modeling data sources to accelerate State’s new software investments, providing curated and validated data for self-service analytics while creating authoritative lists for persons, places, State assets, and State projects to improve data quality and support self-service analytics. Key datasets include, but are not limited to:

i. Organizational Data

ii. Employee Data

iii. Location Data

iv. Geography/Geo-hierarchy

v. Project Data

vi. Maintainable Asset Data

vii. Federal Real Property Reporting Data

d. Solution must offer a single project analytics reporting application, including relevant ontology objects for analyzing project performance across the organization. The solution will integrate data from various sources into a cohesive data asset for enhanced project insights. The project analytics and reporting solution will include:

i. Implement app-like features in a comprehensive project report to enhance user experience.

ii. Introduce a feature that highlights changes in values over a specified date range.

iii. Develop capabilities for regional, program, and project type reporting to allow detailed analysis of data as it aggregates into specific reporting categories.

iv. Create a tool for comparative analysis across projects, focusing on key metrics to identify deviations from standard performance benchmarks.

v. Design the reporting framework to emphasize true key performance indicators (KPIs), distinguishing more critical data points from general indicators.

vi. Replace manual, self-reported project health assessments with a logic-based system. Develop automated health scores (Red, Yellow, Green) based on quantifiable project data and performance metrics.

vii. Enable teams of various sizes to generate reports based on unique requirements, while maintaining the ability to aggregate data into a broader, programmatic overview.

e. Solution must be capable of providing mature data management capabilities through a single enterprise platform, utilizing industry standard frameworks to establish business rules. The enterprise platform is expected to provide a data management/governance model. AI models on the backend will be used to conduct predictive analysis using data mining, historical, and statistical data to identify areas of interest for informed decision making. The solution must provide a methodology for State to access and control data to stay informed and make data driven decisions.

Additionally, the solution shall:

i. Ensure that all data written to the platform maintains its metadata, lineage, and provenance within an integrated data foundation (e.g., self-documenting code), and can be used alongside data native to the foundation.

ii. Provide the ability to create a dynamic data model, object-based search/discovery, and analysis workflows, allow easy definition of objects, properties, and links that propagate from a source table, and provide intuitively designed ways to move between tabular and object-oriented interfaces and data analysis.

f. Solution must provide efficient operations and work assignments to maximize data analytics and reporting, interface with interagency systems (unclassified and classified), commercial, and external open-source data feeds, ensuring real-time interconnectivity and specific technical and operational oversight, and standardize and consolidate siloed information into a single system of record. Additionally, the solution must:

i. Enable analysts to perform advanced analytics in their preferred coding languages (e.g., Java, Python, R, SQL) and in non-code-based tools, all within the same platform.

ii. Provide the ability to display and filter statistical information in interactive tabular and chart formats.

iii. Provide collaboration capabilities (e.g., shared workspace, reports) enabling teams comprised of technical and non-technical roles to work concurrently on the same data and merge analytical paths.

2.4 Security, Access Controls, and Data Governance

State requires a highly secure solution that offers comprehensive access controls and robust data governance methods to ensure the protection and proper management of sensitive information.

a. Solution must support secure handling of information of various classification levels and provide access controls to ensure users have access to only the data and information aligned to their level of security clearance.

b. Solution shall have a security and auditing subsystem to enforce security in the solution. The solution must provide authorization of resource access to users who have been authenticated.

i. The platform should capture audit logs on all resource access requests throughout the system, including import, read, write, search, export, and deletion attempts along with the user, time, date, and action.

ii. Security and access controls that include:

1. Multi-source authentication (enterprise LDAP, PKI, Active Directory, etc.) as well as Single Sign-On (SSO) capabilities.

2. Exposed OAuth 2.0 interfaces to facilitate authorization with external applications with either Authorization Code Grant or Client Credentials flows.

iii. Proven API Integrations with:

1. Privacy-preserving record linkage (PPRL) solutions providers to facilitate secure data linkage.

2. External third-party systems for pass-through of credentials to facilitate rapid access to external data and/or the running of jobs on external systems directly from the platform.

c. Access controls to secure each piece of information individually in addition to traditional blanket permissions across entire data sources.

d. Solution must be capable of implementing an enterprise-level data governance suite to ensure secure, controlled access while facilitating effective data sharing. Data stewards and administrations must be able to quickly identify data quality gaps and rectify them. The governance suite will include:

i. A cataloging function for end users to search for data, enhancing access and support while also reducing duplicate data within the Department.

ii. Provide multiple user types so that data producers, data consumers, data stewards, model stewards, and administrators from inside and outside of State can all seamlessly work together in an easy-to-use solution.

iii. AI-powered chatbot assistant that streamlines the process of finding and accessing data within an organization. The assistant will be designed to efficiently guide users to the specific data they require, offer assistance when data cannot be directly found, and recommend further actions, including contacting relevant points of contact or exploring additional resources for help. The assistant shall also ensure users are provided access only to the data sources aligned to the user’s clearance level to maintain security.

iv. Solution should include a comprehensive framework for managing Service Level Agreements (SLAs) associated with each data asset within the system. Focusing on the detailed identification, documentation, and monitoring of key metadata attributes for every data asset to ensure they meet the predefined standards of availability, reliability, and usability required by stakeholders and users.

v. Solution should also allow administrators and governance officials to communicate and document the fidelity of data and models within the system, clearly communicating to users the trustworthiness of the data and models along with what they should/should not be used for.

vi. Solution should seamlessly update and integrate new data assets into the API as they become available through the governance app, ensuring automatic, real-time access to the latest information without manual intervention.

vii. Solution shall implement a business glossary that serves as a centralized repository for the standardized definitions, terminologies, and key business concepts used across the organization.

e. Ability to assign individual users granular permissions to data access (including ownership, read, write, access denied, etc.).

f. Role-based access controls (RBAC) which are assignable to individual users or group of users.

g. Ability to restrict post-harmonization data access to data owners involved in harmonization for data quality checks.

h. Ability to validate harmonized data from across data owners in a controlled environment limited to administrators and release data to broader user base upon validation.

i. Ability to assign sensitivity markings to data at ingestion and retain markings through downstream processes (including transformation and analysis) to automatically prevent data from being used by projects or users that do not have the necessary approvals while permitting users to share data and results that are permissible across projects.

j. Ability to configure an in-platform data use and data download request and approval process to facilitate purpose-based data access and use.

i. The solution should have the ability to enable users to request access to data at a given tier of information and provide justification using an in-platform form.

ii. Administrators should be automatically notified of the request as well as be able to grant or decline the request within the solution.

iii. The platform should automatically capture any relevant metadata about the request for transparency and auditability.

k. Access and role-based access controls that:

i. Can be assigned or revoked by administrators at any time (including data owners) and/or inherited from source systems and updated at any time.

ii. Are based on the principle of least privilege and require privileged access for access administration.

l. Propagation and inheritance of access controls to all data and analyses derived directly or indirectly from the originating data, whether those data transformation or analyses are performed:

i. In a standard language (Java, SQL, Scala, Python, etc.).

ii. A technical scripting language (R, SAS, etc.).

iii. A point-and-click analytical environment.

2.5 Scalability and Customization

State requires a COTS solution to be flexible and scalable to enable expansion of AI features and broader analytical functionality to keep pace with the rapid evolution of AI technologies and the continuously evolving mission requirements at State.

a. Solution must be a highly customizable COTS platform that enables applications, analyses, and workflows to be tailored to meet specific mission needs and user requirements.

b. Solution must have the ability to scale with increasing users, data, and pipeline complexity, while providing fine-grained ways to adjust resource consumption-including auto-scalable containerized compute.

In addition, solution must have a proven ability to scale up to thousands of users (including thousands of potential outside collaborators globally), petabytes of raw and processed data, daily updates in the terabytes, and management of thousands of complex pipelines requiring processing components developed in a variety of languages and environments.

2.6 Accessibility and User Experience

State requires the solution to be versatile and user-centric, ensuring accessibility from various devices and browsers while maintaining a consistent and intuitive user experience. The solution should cater to both technical and non-technical users, providing tools for easy application development and automation without the need for extensive coding.

a. Solution must comply with all Section 508 requirements.

b. Solution must enable access from various device types (mobile, tablet, desktop) and browsers (Chrome, Firefox, Safari).

c. Solution must produce a consistent layout and an accessible user experience across specified device types and browsers.

d. Solution must provide a user-friendly interface for both technical and non-technical users that supports seamless interaction with AI tools and applications.

e. Solution must provide clear error messages and offer effective feedback during system timeouts or other operational failures.

f. Solution must provide No Code/Low Code which leverages an intuitive and graphical interface to give users the power and freedom to quickly build applications and automate business processes without having to write code line by line.

2.7 Training and Support

The solution shall constitute a significant change to State’s business processes, tactics, techniques, and procedures. Users will need training and exposure to the capabilities of the system in order to ensure proper adoption. Further training will be required for State’s “power users” and system administrators. This training shall be provided as requested and required by State as part of the integrated solution.

a. Solution must include comprehensive training and enablement for users to develop AI skills.

b. Solution must provide and deploy support teams that can scope, prototype, and troubleshoot in real-time in accordance with government security standards.

2.8 Other Considerations

a. Given the nascent and continuously evolving nature of AI capability, please provide information on any additional unique capabilities or practical experience your solution can bring to support State’s AI requirements.

b. Does your solution currently have an active or provisional State Department Authority to Operate (ATO)? If your solution has an active or provisional, please provide an overview of the ATO, including the scope and what it covers.

3.0 PAST PERFORMANCE

State is seeking a solution that has a proven track record in the U.S. federal space with demonstrated experience supporting Agencies of similar size, global scope, and mission complexity as State. Such experience is critical to ensuring the solution has been proven to be secure and reliable under the required IT security, data management, privacy and other federal regulations that govern information technology implementations within the federal environment.

Please provide the following information regarding your experience deploying your solution for federal customers.

1. Please list all federal agencies where you have successfully deployed your solution in the last five (5) years. For each experience noted, in no more than one paragraph, please provide:

a. Agency and Organization name

b. Period of Performance

c. Solution provided to the Agency

2. For at least one, but not more than three, of the federal implementations provided in #1 above, please provide the additional detailed information requested below to further demonstrate your relevant past experience.

• Contract and task order number

• Contract type

• Dollar value of contract (across full period of performance)

• Period of performance dates

• State whether your company was a prime or subcontractor.

• Customer point of contact (Name, Title, Email, Phone) that State may reach out to for more information.

• Description of the scope of the work your company performed and its relevance and applicability to demonstrating your solution’s ability to deliver the full set of capabilities outlined in Section 2.

• Additional information where contingent operations were supported by the solution and what objectives needed to be met for contingency operations.

Disclaimer: This Sources Sought Notice is for information gathering purposes only as a means to identify interested and capable sources that can provide a solution that fully meets all requirements outlined in Part 2 of this notice. The information provided in this Notice is subject to change and is not binding on the Government. State has not made a commitment to procure any of the items/services discussed, and release of this SSN should not be construed as such a commitment or as authorization to incur cost for which reimbursement would be required or sought.

State will not publicly disclose proprietary information obtained as a result of this SSN. To the full extent that it is protected by law and regulations, information identified by a respondent as Proprietary or Confidential will be kept confidential.

All submissions become Government property and will not be returned.