Virtualization and Hybrid Cloud Infrastructure _RFI revised 12162024.pdf

1019530027

SENSITIVE BUT UNCLASSIFIED

U.S. DEPARTMENT OF STATE

BUREAU OF DIPLOMATIC TECHNOLOGY (DT)

OFFICE OF INFORMATION TECHNOLOGY ACQUISITIONS (ITA)

REQUEST FOR INFORMATION (RFI)

for

ENTERPRISE VIRTUALIZATION AND HYBRID CLOUD INFRASTRUCTURE SERVICES

PART 1: REQUEST FOR INFORMATION BACKGROUND AND OBJECTIVES

1.1 PURPOSE

This request for information (RFI) is issued as market research to determine industry’s capabilities to provide a proven commercial-off-the-shelf (COTS) enterprise hybrid cloud computing software and infrastructure platform able to provide an integrated suite of software products that can effectively operate, automate, monitor, and manage virtual desktops, servers, networks, data, memory, and storage services which support a broad range of critical business processes at State.

Additional specific capability requirements are enumerated in Part 2 below.

The Government does not commit to award a contract on the basis of this RFI or reimburse any costs associated with the preparation of responses. This RFI is issued solely for information and planning purposes and does not constitute a solicitation. All information received in response to this RFI that is marked “Proprietary” will be handled accordingly. Responses to the RFI will not be returned. In accordance with FAR 15.201(e), responses to this RFI are not offers and cannot be accepted by the Government to form a binding contract.

Responses to this RFI will assist State in determining the potential level of interest, competition adequacy, and technical capabilities of commercial vendors to provide the required products and/or services. The Government does not guarantee any action beyond this RFI.

1.2 BACKGROUND

State’s mission is to advance the interests of the American people, their safety, and economic prosperity by leading America’s foreign policy through diplomacy, advocacy, and assistance. The mission of the Bureau of Diplomatic Technology (DT) is to rapidly and securely deliver, anytime and anywhere, the knowledge resources and Information Technology (IT) services needed to support over 300 sites and 275 missions it services worldwide.

DT is seeking information from industry regarding their capability to provide market-leading solutions capable of meeting the full breadth of functional requirements outlined in this RFI. State requires access to a platform that is compliant with current federal security requirements, is easy to use, flexible, scalable, customizable, and configurable to meet specific State requirements as further detailed below.

1.3 RFI OVERVIEW

As further detailed in Section 2, State is seeking to identify capable and interested partners able to provide the products and/or services required to meet the full range of functional capabilities outlined in this RFI. Viable partners shall have demonstrated experience deploying the solutions in the federal environment and delivering the ongoing support required to maintain, expand, and upgrade the solution over time for an organization of similar size, global scope, and mission complexity as State.

Information requested in this RFI includes the following categories:

➢ Company Information (Section 1) – Identification of interested vendors, socio-economic status, and potential acquisition vehicles to inform State’s potential acquisition strategy options.

➢ Capability Assessment Against Functional Requirements (Section 2) – Description of vendor’s proposed technical solution and ability to fully meet all stated functional requirements.

➢ Past Experience (Section 3) – Past project example(s) demonstrating vendor’s experience implementing their proposed solution in the federal environment to address the needs of an organization of similar size, global scope, and mission complexity to State.

1.4 SUBMISSION INSTRUCTIONS:

All written responses should be submitted in Microsoft compatible formats (e.g., Word) or PDF.

Responses shall use 12-point font and 1-inch margins, including all text, tables, and graphics. Additional attachments, brochures, or other marketing materials are not requested and will not be considered as part of the response. Response page limit(s) by section are noted below.

• Section 1 – 1 page

• Section 2 – 20 pages

• Section 3 – 5 pages

Please submit all materials to John Warner at WarnerJ1@state.gov by Monday, January 6, 2025 at 5:00 pm EST.

UNDER NO CIRCUMSTANCES SHALL ANY RESPONDENT CONTACT ANY STATE

PERSONNEL REGARDING THIS NOTICE.

mailto:WarnerJ1@state.gov

PART 2: REQUESTED INFORMATION

Respondents are asked to provide the information requested below in accordance with the instructions outlined in 1.4 above. Submissions not adhering to the submission instructions may be deemed non-responsive and may receive no further consideration.

Section 1 – Company Information

Please provide the following details regarding your organization:

a. Company name

b. Company’s point of contact (POC) name

c. Company’s point of contact (POC) phone number

d. Company’s point of contact (POC) email address

e. Company’s URL/web address

f. Company’s Cage Code

g. Company’s UEI Number

h. Company business size in terms of revenue and number of employees

i. Company federal socioeconomic classification(s), if any, based on North American Industry Classification (NAICS) Code that applies to the proposed solution.

j. List GSA schedule, Government wide acquisition contracts (GWACs), or other federal IDIQs or contracts the Respondent holds that are accessible by State and where the full proposed solution can be procured, including corresponding schedule number or contract number.

Section 2 – Functional Requirements Assessment

State’s functional requirements for the solution are outlined below. Respondents are asked to provide a structured response that meets the following format requirements:

a. Response must be structured and annotated to clearly map the detailed description of the proposed solution’s capabilities to the numbered requirements captured in the sections below. Responses that do not clearly map to the information stated in the listed requirements below or are otherwise unclear regarding where a particular requirement is addressed may be deemed non-responsive and may not receive further consideration.

b. Response narrative content should provide sufficient details regarding the proposed solution’s specific technical capabilities to demonstrate that the solution is capable of fully satisfying each stated requirement. Responses that lack sufficient detail to explain how and to what extent the solution’s capabilities achieve the stated requirement or simply state the solution meets the requirement, may be deemed unresponsive and may not receive further consideration.

2.1 Mandatory Qualifications

The following qualifications and capabilities are mandatory requirements for any potential solutions addressing the needs outlined in this notice. Respondents should assess these “Go/No-Go” requirements carefully, as solutions unable to meet these requirements will not be considered as viable options by State and will not receive further consideration:

a. The solution shall provide proven, enterprise-grade, commercial-off-the-shelf (COTS) products (no custom-built solutions) with demonstrated experience successfully deploying and operating in the Federal environment.

b. The solution shall provide a unified platform integrating computing, storage, and networking with cloud management with a seamless, fully integrated, and automated software stack.

c. The solution shall provide a unified view of the entire infrastructure, from the hardware to software, and all applications running on it.

d. The solution shall include advanced automated lifecycle management capabilities that automate patching, upgrades, and monitoring to ensure on-premises/hybrid cloud infrastructure remains secure and up to date with limited burden on State IT staff.

e. The solution shall provide a common infrastructure for hybrid cloud compatible with all major cloud service providers (CSPs) including, but not limited to, Azure, Amazon Web Services (AWS), Google, International Business Machines (IBM) and Oracle, delivering consistent infrastructure as code across public, private, and edge cloud environments. Please provide information on all compatible CSPs for the proposed solution.

f. The solution shall be capable of running on bare metal with all major CSPs and enable streamlined and low-cost migration between CSPs when needed.

g. The solution shall enable State to deploy solutions within the core infrastructure that can be used at scale across public clouds and edge locations without having to refactor the applications or cause unreasonable re-train efforts for engineering staff. Please describe how the proposed solution accomplishes this objective.

h. The solution shall deliver workload independence from physical locality with a management plane that provides a consistent management experience, enabling users to focus on desired outcomes instead of the management nuances of a siloed data center.

i. The solution shall offer production support, including phone support, with

“US citizen on US soil 24x7 coverage” to support continuity of operations for State’s global footprint. Please note whether this level of coverage is included in the base platform at no added cost or is available at an additional cost as a separately priced item.

Mandatory Certifications and Standards

Please confirm whether the proposed solution holds the following certifications or meets the following standards. For each element, please note whether documentation confirming such compliance can be provided upon government request.

j. The solution shall be compliant with Federal Information Security Modernization Act (FISMA) security standards and have Federal Risk and Authorization Management Program (FedRAMP) certification at the High Impact Level.

k. The solution shall offer a cloud computing platform that is able to support the full spectrum of Intelligence Community security levels, including possessing a Department of Defense (DoD) Impact Level 6 High (IL6) certification for storage and processing of classified information up to the top-secret level.

l. The solution shall meet National Institute of Standards and Technology (NIST) definitions of Cloud Computing as published in NIST Special Publication 800-145.

m. The solution shall fully comply with Federal Information Processing Standards (FIPS) 140-2 standards or higher.

n. The solution shall meet System and Organization Controls (SOC) compliance, International Organization for Standardization (ISO) 27001, ISO 27017, ISO 27018, CSA STAR, Cyber Essentials, SecNumCloud, European Union Agency for Cybersecurity (ENISA), Information Security Registered Assessors Program (IRAP), Information System Security Management and Assessment (ISMAP), Payment Card Industry Data Security Standard (PCI DSS), and Health Insurance Portability and Accountability Act (HIPAA) requirements.

o. The solution shall map to the NIST Cybersecurity Framework (CSF) using the NIST 800-53 Control Family.

p. The solution shall address all Zero Trust pillars in the Cybersecurity and Infrastructure Security Agency (CISA) Zero Trust Maturity Model, enabling the enterprise to meet these pillars in a single stack from a single vendor.

q. The solution shall be fully compliant with the requirements of Section 508 of the Rehabilitation Act of 1973, as amended, and vendor shall be able to provide copies of the VPATs (Voluntary Product Accessibility Template) supporting such compliance.

r. The solution shall comply with State’s Cybersecurity Supply Chain Risk Management (C-SCRM) policy. Please review the attached C-SCRM Questionnaire and Software Producer Attestation forms and note whether your company is able to provide the requested information and attestations for your proposed solution. Both documents shall be/must be submitted with responses.

2.2 Enterprise Virtualization Solution

State requires a robust and scalable virtualization solution that can deliver virtualized services and applications to State employees around the 270+ global posts and numerous domestic offices located throughout the United States, as well as supporting a wide set of options for mission-critical applications across multiple departments. The solution shall ensure high performance, reliability, security, and flexibility to accommodate a complex software-defined network, future growth, and evolving operational needs.

a. The solution shall provide enterprise desktop virtualization services, enabling multiple desktop environments to work on a common platform.

b. The solution shall provide enterprise server virtualizations services, enabling virtual machines to run on a single server.

c. The solution shall provide enterprise network virtualization services.

d. The solution shall provide enterprise data virtualization services.

e. The solution shall provide enterprise memory and storage virtualization services, enabling multiple physical memory and storage assets across the enterprise to function as a singular memory and storage pool.

f. The solution shall support software defined networking.

g. The solution shall support software defined storage.

Performance and Scalability

h. The solution shall support high performance computing across a hybrid and multi cloud environments.

i. The solution shall be capable of simple and mass deployment.

j. The solution shall provide extensibility and scalability across a hybrid cloud environment. Please provide details of the solution’s capabilities in this regard.

k. The solution shall allow users to access their personal work desktop setup on government furnished equipment (GFE), personal (BYOD), and company owned, business owned (COBO) devices from local or remote locations.

l. The solution shall provide a centralized and universal hub for monitoring multiple virtualized environments. Please provide details of the solution’s capabilities for centralized monitoring.

m. The solution shall be capable of 24/7 monitoring of all virtualization services’ performance and send automatic alerts to relevant stakeholders informing them of potential issues/failures before they become issues/failures.

Reliability and Availability

n. The solution shall ensure high availability and minimal downtime, with features such as clustering, distributed resources, replication, scheduler cluster, fault tolerance for high availability cluster, and automated failover, ensuring that critical systems always remain operational. Please note the proposed solution’s typical service level agreements (SLAs) and performance metrics for high availability.

o. The solution shall be able to support active backups and recovery with minimal or no data loss by committing to rapid recovery time agreements (e.g., committing to service level agreements with State for recovery time and recovery point objectives). Please note the proposed solution’s typical SLAs and performance metrics for rapid recovery.

p. The solution shall implement disaster recovery solutions to ensure data integrity and availability in the event of system failures or disasters, including regular backups and failover mechanisms.

q. The solution shall ensure 99.999% up time, when not conducting system maintenance.

Advanced Features and Modernization

r. The solution shall be capable of running on nearly any operating system and on bare metal. Please list all compatible operating systems for the proposed solution.

s. The solution shall virtualize a multitude of guest operating systems including older versions to allow users, developers, and IT administrators to run older software, including but not limited to Windows, Linux, FREE BSD, Unix, and macOS.

t. The solution shall be capable of cloning virtual machines.

u. The solution shall support live migration of virtual machines between hypervisors.

v. The solution shall provide a universal hub for managing multiple virtual environments to configure virtualized and cloud computing environments.

w. The solution shall support third party management tools and backup solutions. Please describe the proposed solution’s breadth of capabilities in this area.

x. The solution shall be capable of using Representational State Transfer Application Programming Interface (REST API) and integrate an API gateway to facilitate secure and efficient data exchange between State systems, ensuring that data can be accessed and utilized by authorized applications and users.

y. The solution shall have native modules with automation APIs.

z. The solution shall provide tools and features to support the modernization of existing applications and migration to new platforms as needed, ensuring State is able to streamline adoption of new technologies.

Integration and Interoperability

aa. The solution shall ensure compatibility with existing systems and software platforms used across State’s global enterprise, enabling seamless integration and data exchange.

bb. The solution shall incorporate security features such as micro-segmentation, Intrusion Prevention and Detection (IPS/IDS), and Network Detection and Response (NDR) to facilitate secure and efficient data exchange with other federal agencies, internal departments, and external stakeholders, supporting collaborative efforts and information sharing.

Please provide details of the proposed solution’s security capabilities.

cc. The solution shall have the ability to allow database level encryption and security.

dd. The solution shall be compatible with Splunk reporting.

Maintenance and Support

ee. The solution shall include access to vendor support for ongoing maintenance, updates, and troubleshooting, ensuring that issues can be resolved promptly and effectively. Please describe the support model for your solution and define what support is included with the solution verses support levels that require an additional cost.

ff. The solution shall provide tools for centralized management, tracking, ordering, renewing, and accounting for licenses and services for streamlining administrative processes and reducing overhead.

gg. The solution shall provide or support active monitoring and alerts for usage, storage, and additional attributes that could cause performance or availability issues in the cloud infrastructure, databases, and virtual machines.

hh. The solution should have capabilities that allow for automation of maintenance functions to drive potential cost savings on regular operations and maintenance costs.

Reporting and Business Intelligence

ii. The solution shall support comprehensive system reporting capabilities to generate clear and actionable insights, enabling the organization to make informed decisions based on accurate data.

Cost-Effectiveness

jj. The solution shall provide efficient management of licensing costs and total cost of ownership, ensuring that State can maximize value while minimizing expenses.

kk. The solution shall implement a hybrid cloud storage architecture that leverages on-prem storage for frequently accessed data and cloud storage for archival purposes, while minimizing egress fees.

ll. The solution shall implement data compression techniques to reduce the volume of data being transferred, reducing the need for repeated egress.

mm. The solution shall not require internet-based product licensing or activation.

2.3 Enterprise Cloud Services

State requires high-performance cloud services to support its critical applications across multiple bureaus and offices globally. The platform shall provide real-time elasticity for State’s enterprise to scale as needed to the exact amount of capacity required for improved efficiency, while providing the most stringent security standards necessary to protect State’s networks.

a. The solution shall be able to support Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) through its cloud services.

b. The solution shall support integration of on-prem and multi-cloud service providers (Government and commercial) seamlessly.

c. The solution shall support hybrid cloud deployments, enable data and application portability, and provide consistent management and security across hybrid environments.

d. The solution shall support hosting of multiple virtual machines.

e. The solution shall support multi-cloud deployments and enable interoperability with other cloud providers (Government and commercial), allowing for the distribution of workloads across multiple clouds for redundancy, cost optimization, and to leverage the unique strengths of different cloud platforms.

f. The solution shall permit building and deploying web and cloud applications, while also ensuring load balancing and provisioning are maintained.

g. The solution shall provide extended support to increase regional resiliency, availability, concurrency, and scalability using cloud infrastructure resources (such as domains and regions) to ensure deployment runs smoothly.

h. The solution shall support multiple Virtual Local Area Networks (VLANs).

i. The solution shall allow users to scale cloud infrastructure based on real-time demand and manage unexpected traffic by scaling the cloud environment for optimal user experiences.

j. The solution shall offer automated IT tasks and intelligent anomaly detection across the environment to predict, prevent, and troubleshoot faster with actionable information.

k. The solution shall offer multifactor authentication and ability for single sign-on.

l. The solution shall require strict resource access controls, such as role-based security or role-based access control (RBAC).

m. The solution shall offer a dedicated service center to address data sovereignty and enable autonomous operation maximizing data security in countries with data privacy requirements and regulations.

n. The solution shall offer the ability to ramp-up to a SaaS model including the ability to migrate cloud environments with full administrative control, bare metal cloud services suitable for enterprise application, and high-performance bare metal servers with local storage.

o. The solution shall provide secure enclaves within accounts, built-in posture management capabilities, patch scalability, and automated issue remediation.

p. The solution shall offer SLAs on availability, performance, and management.

q. The solution shall provide a geographically diverse cloud solution that offers on-demand self-service, broad network access, resource pooling to serve multiple customers, rapid elasticity, and measured services.

r. The solution shall be consumable by heterogenous thin or thick client platforms.

s. The solution shall perform all self-provisioning functions from web-based user interface and at a minimum, be fully compatible with specific operating systems and web browsers utilized within State, such as Google Chrome and Microsoft Edge.

2.4 Security and Compliance

State requires a zero trust IT security approach to ensure the enterprise’s sensitive data is kept safe. Zero trust helps State strategize with a thorough approach to counter potential external or internal threats to complex networks, especially as the enterprise processes data using classified and unclassified networks. State requires access to a solution that is committed to security and meets or exceeds core federal IT standards, such as the FedRAMP High Impact and the DOD Cloud Computing IL6, as well as meeting SOC compliance, ISO 27001, ISO 27017, ISO 27018, CSA STAR, Cyber Essentials, SecNumCloud, ENISA, IRAP, ISMAP, PCI, and HIPAA requirements. In addition to these and the other security standards outlined in the Mandatory Qualifications (Section 2.1) the solution shall provide the following additional security and compliance related capabilities.

a. The solution shall include advanced security features such as micro-segmentation, network encryption, and secure boot processes critical for protecting sensitive data and meeting State security requirements.

b. The solution shall have demonstrated experience supporting and operating at all levels of security enclaves, both classified and unclassified.

c. Please note whether your proposed solution is compliant with the Defense Information Systems Agency Security Technical Implementation Guide (DISA STIGs).

d. The solution shall provide a comprehensive security offering integrating state-of-the-art security tools across desktop, mobile, cloud, and data center environments to provide robust threat detection and prevention, identity and access management, and endpoint security across State’s enterprise.

e. The solution shall provide robust security features to protect sensitive data, including encryption, access control, and auditing, ensuring compliance with organizational and regulatory requirements.

f. The solution shall ensure compliance with relevant regulatory and security standards, including data privacy laws and industry-specific regulations, providing assurance that data is managed responsibly and securely.

2.5 Training and Support

a. The solution shall offer dedicated support services, including technical assistance, troubleshooting, and consulting, to ensure State can access expert support when needed. Please elaborate on the comprehensiveness of the support model included in your proposed solution and whether such support is included in the base solution or is available as an upgrade for an additional cost.

b. The solution shall offer a comprehensive suite of training and technical resources to ensure State personnel are able to effectively utilize and manage the platform to optimize results. Please elaborate on the training and technical resources included in your solution. For each type of resource, note whether the resource is included in the base platform at no additional cost OR is available at additional cost as a separately priced item.

Section 3 – Past Performance State is seeking a solution with a proven track record in the U.S. federal space with demonstrated experience supporting Agencies of similar size, global scope, and mission complexity as State. Such experience is critical to ensuring the solution has been proven to be secure and reliable under the required IT security, data management, privacy, and other federal regulations that govern information technology implementations within the federal environment.

Please provide the following information regarding your experience deploying your solution for federal customers.

a. Please list all federal agencies where you have successfully deployed your solution in the last five years. For each experience noted, in no more than one paragraph, please provide:

i. Agency and organization name

ii. Period of Performance

iii. Solutions provided to the agency Point of Contact Name, email and phone State can contact regarding this experience

b. For at least one, but not more than three, of the federal implementations noted above, please provide the additional detailed information requested below to further demonstrate your relevant experience.

i. Contract and task order number

ii. Contract type

iii. Dollar value of contract (across full period of performance)

iv. Period of performance dates

v. State whether your company was a prime or subcontractor

vi. Customer point of contact (Name, Title, Email, Phone) that State may reach out to for more information and

vii. Description of the scope of the work your company performed and its relevance and applicability to demonstrating your solution’s ability to deliver the full set of capabilities outlined in Section 2

Disclaimer: This REQUEST FOR INFORMATION is for information gathering purposes only as a means to identify interested and capable sources that can provide a solution that fully meets all requirements outlined in Part 2 of this notice. The information provided in this Notice is subject to change and is not binding on the Government. State has not made a commitment to procure any of the items/services discussed, and release of this RFI should not be construed as such a commitment or as authorization to incur cost for which reimbursement would be required or sought. State will not publicly disclose proprietary information obtained as a result of this RFI. To the full extent that it is protected by law and regulations, information identified by a respondent as Proprietary or Confidential will be kept confidential. All submissions become Government property and will not be returned.

END OF SECTION