AOUSC_Cloud_RFI_Questions.pdf

Request for Information for the Judiciary Cloud Services Acquisition Strategy

Background:

The Judiciary is seeking to establish an enterprise hybrid cloud environment to support The United States Judiciary’s current and future IT computing and storage needs. As they proceed through their multi-phase approach for cloud adoption, the Technology Solutions Office (TSO) will refine and build upon its strategy and plans, as well as mature existing guidance. The Judiciary has implemented an on-premise cloud using VMWare and Red Hat OpenStack Platforms and anticipates expanding its cloud offerings to include off premise cloud services. The Judiciary is also using O365 in an Azure environment.

RFI Questions:

The Judiciary is looking for answers to the following questions in order to help the Judiciary understand the availability of services in the current cloud provider environment. Please provide responses to as many questions below as your organization believes is relevant to the services that it provides. The Judiciary does not expect each respondent to address each question. Instead, The Judiciary is requesting industry to focus on and respond to those questions that are in alignment with their area of specialty or expertise. Please provide concise and brief responses.

1. The Judiciary is looking for information on the implementation and success of Federal Government contracts for a cloud broker that provides multiple cloud environments. Please provide any examples of contracting to a Federal Government entity for a single cloud broker that provides the Government multi-hybrid cloud environments to utilize and describe the benefits and issues experienced. Please provide contract numbers and/or Government points of contact along with your response.

2. In reference to Question #1, what procurement methods has your organization used on previous Federal Government acquisitions that give customers the option of provisioning from a choice of cloud environments in a quick and efficient manner? Please provide contract numbers and/or Government points of contact along with your response.

3. In reference to Question #1, if your organization has not implemented a procurement method within the Government but has a suggestion on how to establish multiple cloud environments within the Judiciary enterprise, please provide your organization’s suggestion with details on how it could work functionally within the constraints of Federal Government contracting.

4. There is a need for Judiciary users to quickly deploy a wide range of cloud services. Please provide details on your organization’s ordering and provisioning process focusing on ordering from a catalog of services, how this catalog is tied to Federal procurement practices, the overall governance process for assessing/evaluating, ordering and processing, provisioning changes to existing configurations, speed of provisioning, and provisioning commercial cloud services such as Infrastructure as a Service (IaaS) and Platform as a Service (PaaS).

5. Describe how your organization’s cloud services integrate with other cloud services (both commercial and on-premise cloud services to provide seamless interoperability for the end user. Are there services that you provide that are not able to integrate with other cloud service providers (CSPs)?

6. The Judiciary hosts a variety of applications that require a range of security postures. Please describe your organization’s history of authorizing Federal Government cloud environments that adhere to FEDRamp High and Medium standards to include timelines for authorization and potential issues during the authorization process. Please also describe the labor and cost differentials between High and Medium standards authorization, provisioning, and maintenance.

7. What risk management requirements were included in your solution? Describe how you integrate and display the continuous monitoring metrics (vulnerability scanning coverage, metrics regarding scanning results, # of devices not agency compliant with established baselines). How do you monitor thousands of devices spread across multiple vendor solutions for unacceptable risk postures?

8. Does the broker have a role-based model that includes a view for a security professional that includes the cloud providers? If using a broker, will those metrics found on the broker’s security and compliance dashboard be carried through to the cloud broker platform or does the information security officer have to use the native cloud tools?

9. Performance monitoring and control are essential for the successful operation of The Judiciary Cloud Services Acquisition (JCSA). Describe the performance monitoring and reporting services your organization provide for a cloud solution including details on what is monitored and the types of reports and automated dashboards available. Please include how you address post incident response (e.g. RCA) . How is automated monitoring setup for your organization’s cloud environment, to include warning and problem notification, which would allow the Judiciary to get real-time data on the status of the entire environment as well as individual statuses for systems/applications within the environment? For cloud brokers, how does your organization provide consolidated automated monitoring for multiple cloud environments?

10. Are there any other deliverables (plans, reports, etc.) that are provided to your public and private sector customers for similar services that your organization believes will be particularly beneficial to The Judiciary? Please ensure that your organization’s response elaborates on the type of information included in the recommended deliverable, the added benefit(s) that can be enjoyed by The Judiciary, as well as recommended performance standards.

11. Please provide a copy of the Service Level Agreements (SLA), or equivalent, that your organization adheres to for Federal Government cloud environments.

12. The Judiciary is interested in how cloud brokers work with cloud providers to not only meet SLAs but also provide VIP support services (i.e. “white glove” services) in an expedited manner.

Please discuss your organization’s model for providing VIP support services, including the process for customers to obtain these types of services in an expedited manner, any Operational Level Agreements (OLA) between a cloud broker and the cloud provider to ensure delivery standards are met, any OLAs between a cloud broker and/or cloud provider and third party applications to ensure that proper technical support is provided, and how costs are captured to account for this elevated level of service.

13. Describe your organization’s mitigation strategies for potential availability and performance issues such as network outages, bandwidth shortages, or spikes in service demand.

14. Describe your organization’s incident/problem reporting and tracking systems, and the ability for authorized customer staff to access those systems directly.

15. Describe the redundancy features of your organization’s cloud services that ensure availability and performance.

16. What are the constraints, if any, around ordering minimums that are typically in place on Federal Government contracts for cloud brokers to be able to provide multiple cloud environments?

17. The Judiciary has the potential to have in place multiple highly complex integrations between cloud environments and internal legacy solutions. How would your organization ensure that SLAs for service requests are meet within standards and are supported by engineers/architects/subject matter experts that are qualified with the environments/tools related to the service request? For cloud brokers, what is the additional time needed to obtain expert support for these types of service requests?

18. Please describe your organization’s transition in and transition out procedures and processes.

Please include your organization’s process on moving both VM and non-VM applications to the cloud environments. Please include the process to minimize time and effort to move a cloud-based application from one cloud environment to another.

19. Please provide any incentives, disincentives, and liquidated damages costs that have been applied to your organization’s Federal Government contracts in the past. Please include a mapping of services/catalog offerings/SLAs to the appropriate incentive/disincentive/liquidated damage.

20. Please provide information on experiences with hosting desktops in the commercial cloud (e.g.

SaaS/VDI as a service or using IaaS for hosting desktops.