AITS_RFI_QA.pdf

AITS Q&A

Industry Day event date: March 20, 2019 │

General Questions

Solicitation-Related Questions

1. We understand FRTIB is considering selecting one or more vendors to support AITS. If a multi-vendor model is chosen for AITS, how does FRTIB envision segmenting the work by vendor across the four services lines in scope?

FRTIB envisions no less than two vendors for the four proposed service lines: Managed Security Services, Back-end Infrastructure, Applications, and End User Services. One of the areas where the agency is looking for industry recommendations is where efficiencies may be best in terms of operation. For instance, we are certain that Managed Security Services must be separate. However, would it be advantageous to combine some of the other three service lines (Infrastructure, End User and Applications)?

2. What is the acquisition timeline?

At this time, we are seeking input and engagement from industry. However, additional timeline information will be forthcoming in the future.

3. Are you going to do a reading room? I would strongly recommend a reading room to ensure innovative outcomes and allow new entrants the ability to propose high availability, cost efficient alternatives.

This is under consideration. We are considering a reading room but have not yet made a final decision nor solidified details

4. Can you tell us who the incumbent is?

SAIC.

5. As it relates to enterprise agreements, are you interested in solutions where you do not own the hardware?

Yes, FRTIB is interested in solutions where FRTIB does not own the hardware/software

6. The RFI references MTIPS – which is a GSA EIS offering not available in the open market. Given the imminent TIC

3.0 policy, are you open to alternative solutions that provides the same outcome?

Yes.

Questions about Transitions

7. Does FRTIB envision the selected vendor(s) will take over the operations of the current legacy solution and then build, migrate, and operate the new solution?

FRTIB anticipates a transition and hand-off of services from the existing vendor to the new solution providers.

We’re looking to industry to provide the best path for a sound transition.

8. Does FRTIB envision the legacy vendor will continue operating the current solution while the selected vendor(s) build the new solution?

FRTIB anticipates a transition and hand-off of services from the existing vendor to the new solution providers.

We’re looking to industry to provide the best path for a sound transition.

9. Does FRTIB anticipate the selected vendor(s) will migrate FRTIB to the new solution and provide ongoing operations support?

Yes, this would be true for all 4 lines of business. We’re looking to industry to recommend the best path for a sound, clean, efficient transition.

10. Will the new vendor(s) be required to interface with the current provider?

Yes. The agency expects collaboration with the existing vendor both during transition. The agency also expects collaboration with all other applicable contractors.

11. Will all four service lines be transitioned simultaneously?

FRTIB is seeking recommendations from industry on best approach for transition(s).

General Questions pertaining to Scope & Current State

12. Please provide Service Now ticket info: (1) how many are received per day/week/month and via what method?

On Average 80-120 service tickets are opened per day for the in-scope requirement via Service Now.

a. What transition time frame between contractors would the government prefer?

FRTIB is seeking recommendations from industry on best approach for transition(s).

b. Does the ATO process for applications reside in any of these service lines?

FRTIB will provide ATO requirements as part of any request for proposal. Industry should assume any new system/application/service introduced into the environment will require an ATO.

c. Can you please clarify what type of data is contained in the system (i.e. PII)?

The agency supports variety of data to include PII. The vast majority of PII data, however, is not contained in this requirement.

d. Can you please clarify the relationship/interaction with these 4 service lines and the custom app development teams?

The Applications service line would have the only interaction with custom applications, and it would be very minimal at that. Additionally, applications will need to comply with the agencies security authorization policies.

e. Please provide total number of users supported along with whether they are @77K or remote.

500 Users at 77 K Street NE and 5-10 remote users via VPN

f. Please provide service level agreements for ticket response.

Please see #14 below

13. How many users access IT services at FRTIB? Internal FRTIB? External FRTIB (Fed Employees for 401K)?

The AITS procurement is focused solely on 77 K Street NE headquarters personnel and teleworkers—roughly 300-500.

14. Would the Government be able to provide how many items exist in the backlog as well as the categorization used (e.g. low, medium, or small, medium) and the SLA, associated around them? Also, can samples of each category of backlog items be shared from the past 6 months that would be indicative of the backlog that will need to be addressed under managed services contract?

Current Categorization is as follows:

• Priority 1 – Two-hour resolution on a 24hr clock

• Priority 2 – Four-hour resolution on a 9hr business hours clock (8am-5pm)

• Priority 3 – Six-hour resolution on a 9hr business hours clock (8am-5pm)

• Priority 4 – Eight-hour resolution on a 9hr business hours clock (8am-5pm)

The current backlog is approximately 110 tickets. Of those, 95% are in the Priority 4 category, and the remainder are in the Priority 3 category.

15. The two data centers you mentioned–do you own them?

No, we do not own the data centers.

16. What if any recordkeeping functions will be required?

None. There are no recordkeeping tasks or functions as part of this effort. All contractors may be required to collaborate with recordkeeping vendors as needed.

Managed Security Services

17. Do you have a desired road map/timeline for transforming FRTIB to managed SOCs? The answer provides industry with an understanding of FRTIB’s risk tolerance.

We cannot provide a timeline at this time. Ideally, the agency would like to be fully transitioned to a MSS by mid FY20

18. Do you use or intend to use AT&T Netbond to connect into CSPs (cloud service providers)?

FRTIB is open to industry recommendations for cloud access point solutions if necessary.

19. What is your cloud transformation strategy?

We’re looking to go to a cloud service provider and are transitioning several services to the cloud.

20. Do you have a multi-cloud requirement or initiative?

We use AWS, Service Now, and Azure for O365 and may have a few others.

21. What is the breadth of the managed security services goals you’re trying to achieve?

We’re interested in solutions that cover the entire breadth of the NIST Cybersecurity Framework. We’re centered on Protect, Detect, and Respond as the core of our focus. If there are other recommendations, we want to hear them. Identify is the next priority followed by Recover.

22. It sounds like you want MSS separated to monitor the other service lines?

Yes, we’re focused on security monitoring to enhance our cybersecurity maturity.

23. What FISMA level are you currently at?

FIPS 199 – Moderate Level.

24. Is Fed RAMP moderate or high?

All our areas are currently FISMA Moderate. There are some areas where tailored high baseline controls will make sense, but that does not necessarily mean the entire NIST control baseline would need to shift to the high watermark.

25. Will solutions need to undergo an ATO prior to migration? Does this apply to all 4 lines of business?

systems will undergo the A&A process in accordance with FRTIB policy. This applies to all service lines.

26. Does FRTIB currently have in place a fully implemented Managed Security Service as described in this RFI?

No. We’re currently operating in a government-owned, contractor operated (GoCo) environment. The managed security services model is new to us.

27. Are there any security appliances at any remote sites?

Yes. However there are likely to be different implementation scenarios at different site.

28. Where do you anticipate this work being performed?

We expect the Managed Security Services work to be performed off-site. In the case of incident investigations/forensics, the expectation will be for the service provider to come on-site.

Infrastructure

29. FRTIB is looking to become more agile. What is currently being done to avoid cloud lock-in (i.e., adopting one cloud option and being stuck with it)?

We are currently using multiple cloud service providers—AWS, Azure—is part of our strategy to avoid cloud lock-in. We’re interested in having more flexibility, reliability, and redundancy.

30. Do you currently use Azure Express Route to connect directly into Azure? If so, at how many locations?

No, we don’t use Express Route at all right now. The agency is open to industry recommendations.

31. Do you operate your own TICs? If so, at both data centers?

No; we use MTIPS, buying the service from the carrier at both datacenters.

32. What are your disaster recovery mileage requirements?

FRTIB does not have prescribed mileage requirement at this time but is recommending vendors have suitable BCP plans and architecture that prevents impacts from things like shared power grids, common weather events, and blast zones

33. Where are the Data Centers located? Are they in a co-location facility?

We are currently co-located. Our future data center requirements must meet the geographical, power grid, weather event, and blast zone consideration requirements mentioned above.

34. Will all externally-bound network traffic be required to go through a TIC? For example, will O365 be required to pass through a TIC if it could reach O365 via Private IP (PIP) connection?

All externally bound traffic currently needs to pass through a secure TIC (TIC 2.0 environment)—following draft guidance for TIC 3.0. However, we are open to industry recommendations for more reliable, Fed RAMP-compliant solutions.

35. Infrastructure: If cost will be a factor in your decision, does that mean you will prefer open source over proprietary software where appropriate?

Not necessarily, the agency is looking for the best solution for each requirement.

36. Did you say you have SailPoint?

Yes.

37. Do you have infrastructure in Azure?

Yes.

38. Is BigFix used for your patch management?

Yes.

39. Which Service Now modules do you have?

Service Management, IT Business Management, Customer Service Management, and IT Operations Management.

40. Will exchange, mail services be included in the Infrastructure line of business?

No, the agency is migrating to Office 365 for its mail and mobile solutions.

41. Are there any cloud instances already? If so which one and who are the CSP?

Yes, we’re using Azure, O365, AWS, and Service Now.

42. What is used for domain authentication? How are privileged users managed?

We comply with HSPD-12 using tools, including CyberArk and SailPoint. We’re moving to a role-based access control (RBAC) solution, eventually moving to an attribute-based access control (ABAC) solution. We’re specifically seeking recommendations for ICAM solutions to better manage communications.

43. How are patches and applications currently installed?

BigFix.

44. Is there a standard dock and desk configuration? Do users have local attached printers?

Yes, we’re in the process of rolling out a Windows 10 migration with 1803. Printers are deployed on a case-by-case basis.

45. Which SaaS solution is being used for email, and MDM?

Office 365 for mail and Microsoft Intune for mobile device management (MDM).

46. Is data archived to tape and then shipped off-site?

FRTIB leverages a tape based solution as our archive medium for the data centers, those tapes are then sent offsite.

47. Is there an updated inventory and rack elevation for the data centers?

Yes.

48. Are data center port mappings documented and maintained?

FRTIB data centers are not in scope for this RFI.

49. Where do you anticipate this work being performed?

Infrastructure services are expected to be offsite

Applications

50. Does the scope of the application work involve O+M, modernization, or both?

Yes for both modernization and O&M.

51. For application dev and O+M, do you use agile methods, or more traditional waterfall? Do you have standards or preferences in this area?

We currently follow a traditional waterfall model. However, we’re open to using more agile methods.

52. Are your applications based on any specific enterprise-standard products or technologies? For example, do you use Java, .Net, Oracle, etc.?

FRTIB currently leverages multiple applications. We are seeking industry best practices for new tools.

53. App Services: are you currently using agile methodologies for develop and/or DevSecOps like automation capabilities?

No, but we’re open to them in the future.

54. Application: are you considering a more lightweight, scalable, app packing structure such as containers?

We’re interested in recommendations from industry that help us meet our business and mission needs.

55. What is FRTIB’s mix of custom-built applications versus COTS software?

As it pertains to this requirement, the vast majority are COTS. There are however a few custom built applications.

56. Are your local applications a reference to desktop applications?

Yes, at a desktop level for local applications.

57. Where do the applications reside which are a part of this RFI for the Applications line of business?

The applications reside in the agency’s two data centers.

58. Is there a list of desktop applications in the environment?

Yes. The agency is considering providing the list of applications in the future.

59. Where do you anticipate this work being performed?

Application services are expected to be performed offsite.

End User

60. Related to enterprise service contracts, does FRTIB prefer to not own equipment as part of desktop/laptop managed service?

Yes

61. Many managed services end user support is delivered from remote locations – offsite. Is the FRTIB open to offsite service desk support?

Yes. However we require on-site deskside support services.

62. Is ServiceNow only used for managing desktop related issues or other non-related desktop issues?

No, it’s used for multiple services and applications.

63. Will end user services be required beyond 77K?

No.

64. Is there a current service catalog that can be shared?

No, not at this time.

65. How are service tickets entered and managed within Service Now?

a. A call to the Help Desk.

b. An email to the Help Desk

c. User entered tickets through the ServiceNow portal.

66. Are there any enterprise agreements for HW (laptops, peripherals) and SW (Microsoft)?

Yes, however we’re seeking better licensing models. We have some traditional methods and models. As we move into a managed service environment, we’re looking to improve.

67. Can we see a Network Topology of the WAN configuration as well as the data center configuration?

FRTIB will provide necessary network topology diagrams as part of applicable requirements package

68. Where do you anticipate this work being performed?

Deskside support services need to be on-site at 77 K Street, however we are open to off-site help desk models.