VDI (DaaS) Q A_6.29.26.docx

Request for Information Desktop as a Service (DaaS) Solution Question Submitted with Answers

1. Which user populations are in scope for this procurement: faculty, staff, students, researchers, clinicians, or all of the above?

All of the above.

2. What are the expected quantities for concurrent users, and peak usage levels for the in-scope populations?

Unknown number of concurrent users but estimated to be less than 1000. It is estimated that peak usage levels will occur during business hours.

3. Which compliance and security frameworks are mandatory requirements for the proposed solution: FERPA, HIPAA, FedRAMP Moderate, FedRAMP High, ITAR, NIST 800-171, CMMC, or others?

FERPA, HIPAA, FedRAMP Moderate, NIST 800-171, CMMC, and NSPM-33 as initial frameworks.

4. Does the university require separate isolated environments or enclaves for any departments, research programs, or regulated data types?

Yes.

5. What administrative hierarchy does the university want the platform to reflect: central IT, colleges/schools, departments, labs, clinics, or other organizational units?

Central IT will control the root and delegate access to the schools/colleges/divisions. UW-Madison has over 100 IT departments and many SCDs have multiple IT departments and subdepartments.

6. What are the authoritative identity and access systems the solution must integrate with, and what device trust or posture signals are available today?

Shibboleth, Active Directory, Entra ID.

7. What restrictions are required for managed, unmanaged, and BYOD endpoints, including browser-only access, clipboard, printing, file transfer, USB, and screen capture controls?

Example restrictions are found in E.43.g.

8. Which workloads require persistent desktops, non-persistent desktops, published applications, Linux support, Windows support, or GPU acceleration, and at what scale?

It is unknown the mix of persistent desktops versus non-persistent desktops versus published applications. Windows will be the primary platform, Linux secondary. GPU acceleration is not a primary consideration.

9. What are the university’s requirements for availability, disaster recovery, regional failover, U.S. data residency, logging/SIEM integration, and department-level cost allocation or chargeback?

99.9% SLA and 24x7x365 support. RTO and RPO are negotiable. US data residency required. Our current central SIEM platform is powered by Elastic. Department-level cost allocation, showback, and chargeback capabilities are preferred.

10. Does the university expect the response to include implementation, migration, operational, or managed services, and if so, which services are expected to be provided by the vendor versus the university?

The University does not require the response to include implementation, migration, operational, or managed services.

11. What purchasing contract would be leveraged if UW-Madison proceeds with the project?

The University may conduct a Request for Proposal and / or determine if there are existing procurement authority options available.

12. What current DaaS solution is UW-Madison utilizing?

UW-Madison does not currently provide a central DaaS solution.

13. Does UW operate an existing VDI or DaaS environment today (Citrix, Omnissa/Horizon, AVD, or on-prem VDI), and is this initiative a migration, a consolidation, or net new?

UW-Madison does not currently provide a central DaaS solution. Individual departments are using Citrix, Omnissa, AVD, and on-prem VDI.

14. Do you currently own any Microsoft AVD / Existing Azure Tenant, Citrix, Omnissa Horizon licensing? M365 A3/A5 licenses?

UW-Madison currently has M365 A3 licenses. There are instances of Citrix currently at UW-Madison but not managed by Central IT. UW-Madison also has numerous Azure subscriptions providing AVDs.

15. The RFI references FERPA, HIPAA, FedRAMP (Moderate and High), ITAR, CMMC, and NIST 800-171. Will these frameworks apply uniformly across the entire DaaS user population, or are the higher-assurance requirements (FedRAMP High, ITAR, CMMC) scoped to specific controlled research enclaves, while the broader faculty, staff, and student population operates under standard commercial compliance?

Frameworks will need to be scoped to specific controlled workloads and populations. In addition to regulatory frameworks, a default compliance policy defined by UW-Madison Central-IT will also be needed.

16. This RFI is structured primarily around DaaS platform capabilities. Will the University accept responses from solution integrators and managed service providers who deliver DaaS by combining a leading platform technology with design, migration, security, and managed or co-managed operations? If so, should we attribute platform native capabilities to the underlying technology, delivery and operational capabilities to the solution integrator?

Responses from managed service providers are accepted. Responses should differentiate capabilities provided by the underlying technology platform and the solution integrator.

17. Can UW share an approximate scale and workload composition? Total expected named or concurrent users, the proportion requiring Linux desktops, and the proportion requiring GPU accelerated desktops for visualization or research?

It is unknown the mix of persistent desktops versus non-persistent desktops versus published applications. Windows will be the primary platform, Linux secondary. GPU acceleration is not a primary consideration.

18. What's the UW campus network posture; Internet2, ExpressRoute/Direct Connect, bandwidth, current VPN reliance? Intenet1, Internet2, both up to 100Gbps capacity.

We would like to have the ability not to require a VPN connection but need the end-to-end connection secure.

19. What is the required uptime SLA, RTO/RPO for DR, support hours (24x7 vs. business hours)?

99.9% SLA and 24x7x365 support. RTO and RPO are negotiable.

20. Are there any specific technologies that must be supported, and are there specialized peripheral needs (smart cards/CAC, dual-monitor, lab USB devices, high DPI)?

Dual-monitor and lab USB devices.

21. What is the UW existing observability tool(s), SIEM and DLP tool(s)?

Elastic, Spirion (data-at-rest discovery), and very limited use of Purview.

22. What does UW existing backup environment look like, both SW/HW? On-prem/hybrid?

Central backup services are provided using IBM Storage Protect and Veeam using on-prem storage. Many cloud environments are backed up using native cloud tools.

23. Scope of Requirements -> Key Objectives -> Bullet 2: Provide an estimate of the number of users who will need access to the HIPAA- and FedRAMP-compliant environments mentioned in the RFI.

Unknown currently. Depends on the schools that adopt the solution. HIPAA users will outnumber FedRAMP users.

24. Vendor Questionnaire – Research and Compliance: are you looking for air-gapped enclave, even within a hyperscaler-hosted environment? Or are you looking for a mix of on-prem and cloud-hosted capability to support isolated research enclave?

The solution can be a mix of on-prem and cloud-hosted.

25. Vendor Questionnaire – Virtual Desktop Storage and Data Protection, Question 43a: are you referring to a physical device being used by an end user, or a virtual device running on any endpoint?

End user physical device if your solution can perform device hygiene and device identity checks. The virtual device should also be able to report posture in its management console.

26. Does the SaaS based portal need to reside in Fedramp?

No.

27. Do you want all of the desktops to be FERPA/ FedRAMP? If not, what percentage of them.

No. Only a small subset of desktops will need FERPA or FedRAMP compliance. It is unknown the breakdown of regulatory compliance needs, but FedRAMP will be a small minority of desktops.

28. Would an enterprise browser be sufficient for some workloads? If yes, what percentage?

Yes, but the percentage is unknown.

29. Is there a requirement that it must be in public cloud?

We are open to both cloud and on-prem solutions.

30. What are the expectations for support of multiple display endpoints?

Dual-monitor and lab USB devices.

31. About the RFI named above, could you provide the details of the current contract providing these services such as contract #, value, and expiration?

UW-Madison does not currently provide a central DaaS solution.