Attachment 3 - QA_2026.08.18.pdf

W50S8G26QOR03 - 250 IS Storage Area Network (SAN)

Issued on: August 4, 2026

Budget Parameters: $175,000 to $275,000

Q&A

Question Due Date: August 14, 2026, at 11:00AM MST

08/04/2026

1. Personnel Security Clearances

a. The SOO Section 6(a) states that all contractor personnel performing on‑site work must possess an active

Secret clearance. Could the Government confirm whether:

i. All personnel entering the SCIF must hold a Secret clearance, or

ii. Only specific technical personnel performing installation/migration require the clearance?

iii. Additionally, will a DD 254 be issued with the award?

Answer: Only specific technical personnel performing logical configuration, data migration, and administrative training require an active Secret clearance. Uncleared contractor personnel (such as delivery drivers, physical movers, or hardware installers strictly mounting physical chassis into racks) are permitted to enter the SCIF under continuous Government escort.

The Government will manage operational security (OPSEC) measures, including masking screens and securing classified media, to prevent any exposure to classified materials during physical installation. Any contractor personnel who will access management consoles, view active system data, or perform logical configuration must possess an active Secret clearance.

Yes. A DD Form 254 will be issued with the award to outline the security classification requirements and escort procedures for the technical phases of the contract.

2. Cybersecurity Requirements (CMMC / NIST SP 800-171)

a. The RFQ includes DFARS clauses 252.204-7012, 252.204-7008, 252.204-7019, 252.204-7020, and 252.204-7021, which normally require:

i. A current NIST SP 800 171 DoD Assessment

ii. Posted SPRS Score

iii. Compliance with CMMC Level 2

b. Could the Government confirm whether these cybersecurity requirements apply to this acquisition and whether compliance must be demonstrated prior to award?

Answer: NIST SP 800-171 DoD Assessment (Required), SPRS Score (Required).

CMMC Level 2 is not required. All work, including data migration and configuration, will be performed on

Government-owned systems within a secure Government facility, the contractor will not be processing or storing

Controlled Unclassified Information (CUI) on their own corporate information systems.

3. AFNet & DIA Supply Chain Requirements

a. The SOO Section 6(b) requires:

i. Equipment listed on the Air Force Approved Product List (APL)

ii. DIA Supply Chain Risk Management (SCRM) vetting

b. Could the Government confirm whether vendors must provide proof of APL listing and SCRM approval with the quote, or only after down selection?

Answer: i. DISA STIG Compliance (Required with the Quote): In alignment with the official sunset of the DoDIN

Approved Products List (APL), offerors must provide proof of cybersecurity readiness with their initial quote submission. All offered hardware specifically storage arrays, controllers, and management servers must be fully compliant with active DISA Security Technical Implementation Guides (STIGs) or possess vendor-supported/DISA-released STIG configurations.

Budget Parameters: $175,000 to $275,000

The contractor shall be responsible for fully implementing, hardening, and validating all applicable STIGs prior to final Government acceptance. Offered equipment that is not STIG-compliant or cannot be hardened in accordance with DISA guidelines will be deemed technically non-compliant.

ii. DIA Supply Chain Risk Management (SCRM) Vetting (Initiated Post-Selection / Pre-Award):

Offerors do not need to provide a completed or pre-approved DIA SCRM vetting validation with their initial quote.

However, offerors must submit all required Supply Chain illumination data including a complete Bill of Materials

(BOM), CAGE codes, and country-of-origin details for all sub-components directly with their initial quote. This ensures the Government can initiate the formal DIA SCRM vetting process immediately upon the technical evaluation and selection of the apparent successful offeror. Final contract award remains strictly contingent upon the selected vendor successfully passing the DIA SCRM vetting process.

4. Payment Terms / WAWF Setup

a. For invoicing preparation, could the Government provide the final DoDAACs for:

i. Pay Office

ii. Issue By

iii. Admin

iv. Inspect By

v. Service Acceptor

Answer: See RFQ page 13 and 14.

08/05/2026

5. Does “storage Filer” require native NAS functionality (SMB/CIFs and/or NFS), or is an iSCSI SAN supporting existing file servers acceptable?

Answer: An iSCSI SAN supporting existing and new virtual/physical file servers is fully acceptable, provided the solution meets the performance, high-availability, and capacity requirements outlined in Section 3.0. While native

NAS functionality (SMB/CIFS/NFS) is a highly desirable feature, it is not a mandatory gating requirement.

6. Is “2TB SLC Flash” intended to mean actual SLC media, or is enterprise SSD technology with equivalent or better performance acceptable?

Answer: Enterprise SSD technology (such as Write-Intensive or Mixed-Use SAS/NVMe SSDs) with equivalent or superior write endurance, throughput, and IOPS performance is fully acceptable. True physical Single-Level Cell

(SLC) media is not strictly required.

7. Is “three separate filers” intended to mean three independent storage arrays (2 production + 1 DR), or three logical file-serving systems?

Answer: The Government’s intent is to achieve physical hardware redundancy and rack-level disaster recovery

(DR) separation within the facility, with the ability to relocate the DR node in the future.

Offerors may offer either a three-chassis solution (mirroring two primary arrays and replicating to a third) or a two-chassis solution (one primary production array and one disaster recovery array).

Budget Parameters: $175,000 to $275,000

If a two-chassis solution is offered, the primary production array must feature fully redundant, active-active hot-swappable controller modules, redundant power supplies, and no single point of failure to guarantee high availability (HA).

In all offered configurations, the Disaster Recovery Site (DRS) array must be configured as a logically independent node replicating data via IP/ISCSI. All hardware will be physically installed on-site at the current facility during this contract; however, the replication architecture must support future physical relocation of the

DR array to another on-base facility without requiring re-licensing or re-architecting of the replication software.

8. Please define the required useable capacity after RAID, snapshots, and data protection, along with expected data growth over the support period.

Answer: To optimize Government funds, the requirement is for a minimum of 50 TB of net usable capacity delivered upon installation. However, the offered storage chassis and controllers must be capable of scaling up to

100 TB of net usable capacity in the future by adding drives, without requiring a forklift upgrade. This 50 TB baseline is sufficient to absorb all projected data growth over the contract period

9. Please provide server requirements (CPU, memory, storage, etc.). Are self-encrypting drives required for storage?

Answer: The Government is open to multiple architectures. Offerors may offer a modern "all-in-one" unified storage solution or a traditional server-based solution, as detailed below.

Path 1: All-in-One / Unified Solution Requirements. If an offeror offers a unified solution that does not require separate physical servers for file sharing, the storage array’s embedded controllers and operating system must natively provide the following capabilities:

a. Native File Services: The system must provide robust SMB/CIFS file sharing services directly from the array controllers over standard IP networks to support Windows-based clients.

b. Active Directory Integration: The system must be capable of joining the local Active Directory domain to manage user authentication and control file/folder permissions using existing security groups.

c. Administrative GUI: The solution must feature a comprehensive, web-based graphical user interface

(GUI) for all administrative tasks, including volume creation, share management, permission assignments, and system health monitoring. This GUI must provide administrators with direct visibility into the file structure.

d. Backup & Replication Engine: The solution must include a built-in or tightly integrated software engine capable of executing automated backups and asynchronous replication to the dedicated disaster recovery

(DR) array.

Path 2: Traditional Server-Based Solution Requirements. If an offeror offers architecture utilizes physical host servers to provide file sharing and/or backup services, the servers must meet or exceed the following minimum specifications:

a. Quantity: A minimum of two (2) physical servers (one for the primary production site, one for the DRS backup site).

b. Operating System: Certified for Microsoft Windows Server (current enterprise-supported version, e.g., Windows Server 2022, 2025, or equivalent). Linux-based host operating systems are not desired due to local administrative training constraints.

c. CPU: Minimum of 1x enterprise-class processor (Intel Xeon or AMD EPYC) configured with the minimum physical cores necessary to efficiently run the operating system, handle active file sharing, and interface with the SAN, while optimizing Microsoft core licensing costs.

Budget Parameters: $175,000 to $275,000

d. Memory: Sufficient Error-Correcting Code (ECC) RAM to seamlessly support the operating system, file-sharing overhead, and any offered backup/replication software without performance degradation

(typically 32GB to 64GB depending on the vendor's software architecture).

10. Can you explain "2x2TB SAS Management Drives” noted for each of the storage node.

Answer: Legacy Context. In the legacy 2019 HPE MSA 2050 architecture, these two (2) 2TB SAS drives were physically isolated and dedicated solely to hosting the array's operating system logs, controller firmware, and native management partition operations.

Modern Replacement Requirement: For the replacement solution, offeror do not need to physically separate management or OS drives if their modern storage architecture natively handles operating system logs, metadata, and management configurations on the primary controller modules, internal flash, or directly within the main storage pool.

Performance Clause. The offered system must, however, guarantee that internal management, metadata, and logging operations do not degrade the performance or reduce the requested 50 TB Day 1 net usable data storage capacity baseline.

11. Is this budget parameters of $175,000 and $275,000 inclusive of the implementation and migration services or is this hardware only?

Answer: The Government's confirms that the budget parameters of $175,000 to $275,000 are strictly all-inclusive, meaning this range must cover the hardware, software, implementation, and migration services. Because this will be a Firm-Fixed-Price (FFP) contract, the Government will not approve any modifications or price increases for missed requirements, hidden fees, travel, or taxes. You must ensure your total quote covering both material goods and labor is completely accounted for and fits strictly within this price parameters, as your company will bear all financial risk for any cost overruns.

12. We are planning to replace our MSA 2050 with an MSA 2070 using equivalent specifications. However, we need to confirm the current host connection type. Could you verify if the existing environment is connected via iSCSI, SAS, or FC?

a. Next, I need the current specs for the DL325 Gen10 and DL360 Gen9 to convert to the latest offerings.

Answer: The existing legacy environment utilizes an iSCSI network host connection (using 10GbE SFP+ copper/fiber transceivers)

For the replacement solution, the storage arrays offered and management/host servers must support a minimum of 10GbE iSCSI connectivity

To establish a baseline for modern equivalents, the technical specifications of the legacy management/host servers are as follows:

1. Primary Host Server (Legacy: HPE ProLiant DL325 Gen10):

Form Factor: 1U Rackmount

Processor: 1x AMD EPYC 7302P (16 Cores, 3.0 GHz, 155W)

Memory: 64 GB DDR4 Registered RAM (RDIMM)

Storage Controller: HPE Smart Array P408i-a (12Gb/s SAS)

Boot Storage: 2x 480GB SATA/SAS SSDs in a hardware RAID-1 configuration.

Network: HPE 1Gb 4-port Ethernet Adapter + Dual-Port 10GbE SFP+ FlexibleLOM adapter

Budget Parameters: $175,000 to $275,000

2. DRS Host Server (Legacy: HPE ProLiant DL360 Gen9)

Form Factor: 1U Rackmount

Processor: 2x Intel Xeon E5-2630 v4 (10 Cores per CPU, 20 Cores total, 2.2 GHz)

Memory: 64 GB DDR4 Registered RAM (RDIMM)

Storage Controller: HPE Smart Array P440ar

Boot Storage: 2x 480GB SATA/SAS SSDs in a hardware RAID-1 configuration.

Network: HPE 1Gb 4-port Ethernet Adapter + Dual-Port 10GbE SFP+ PCIe adapter.

Note: offerors offering server-based architecture must provide modern-generation equivalents that meet or exceed these physical compute, memory, and network throughput baselines.

08/06/2026

13. What file access protocols are required? (SMB, NFSv3, NFSv4, S3)?

Answer: Mandatory Protocol. SMB (specifically SMB v2.x and SMB v3.x) is strictly required. The entire workstation client base is Windows-centric, and maps share natively via standard Windows File Sharing

(SMB/CIFS).

NFS Support (Optional/Desirable). NFSv3/NFSv4 support is not a mandatory requirement for workstation access but is desirable for backend system administration or if utilized natively by the offered replication software.

S3 Support. S3 object storage compatibility is not required for this effort.

14. Is iSCSI mandatory for production workloads or only for legacy compatibility?

Answer: For Server-to-SAN Connections (Traditional Architecture): Yes, iSCSI is mandatory. If the offered architecture utilizes physical host servers connected to a block SAN, the connection between the servers and the

SAN must utilize 10GbE iSCSI.

For Unified/All-in-One Solutions: No. If a unified SAN/NAS solution is offered that serves files directly to workstations without separate host servers, the array may utilize standard 10GbE Ethernet (SMB/CIFS) for production file-sharing workloads over the local area network.

Physical Interface Flexibility (Mandatory): Regardless of the architecture chosen, the offered storage controllers and host servers must support standard 10GbE network speeds. Both 10GBASE-T (RJ45 copper) and 10GbE

SFP+ configured for LC-to-LC fiber optic connections are fully acceptable. Offerors shall coordinate with the

Government during the site visit to match the exact physical cabling and transceiver requirements of the existing rack switches.

15. Does “three distict filers” require three independent physical systems or are three logical systems acceptable?

Answer: Minimum Chassis Requirement: The Government does not require three independent physical chassis if the offeror offers a modern, highly available active-active architecture. A minimum of two (2) physically independent systems is required:

Primary Production Storage System: May consist of either a single physical chassis configured with fully redundant, hot-swappable dual Active-Active controller modules (with no single point of failure), or two (2) physically independent mirrored chassis.

Budget Parameters: $175,000 to $275,000

Disaster Recovery (DR) Storage System: Must consist of at least one (1) physically separate chassis configured as a logically independent target for remote backup and replication.

Logical Partitioning: Offering a single physical chassis that is merely partitioned into logical systems to host both production and DR workloads on the same hardware is not acceptable, as it does not meet the Government’s requirements for physical rack-level redundancy and disaster recovery.

16. Is software-defined data protection acceptable in lieu of administrator-selectable RAID levels?

Answer: Yes, software-defined data protection is fully acceptable. The Government does not mandate traditional hardware-based RAID controllers, provided the offered software-defined storage (SDS) or virtualized storage architecture meets or exceeds the following resiliency baselines:

a. Dual-Drive Failure Tolerance: The primary data protection scheme (whether using traditional RAID 6, RAID-Z2, or Erasure Coding equivalents) must be configured to tolerate the simultaneous, catastrophic failure of at least two (2) physical drives in any storage pool without data loss or downtime.

b. No Single Point of Failure: The software-defined storage layer must natively support active-active controller failover and redundant physical paths (multipathing) to ensure continuous data availability.

c. 50TB Usable Baseline: The software-defined overhead must be factored into the quote to ensure the final, formatted file server environment still delivers a minimum of 50TB of net usable storage.

17. Is a solution comprised of HPE Block storage plus HPE file storage acceptable if all functional requirements are met?

Answer: Yes, this is fully acceptable. The Government does not mandate single, homogeneous physical architecture. Offering a hybrid solution such as a combined block-storage SAN array paired with a dedicated file-storage array or gateway is acceptable, provided that the entire system functions as a unified, seamless storage environment.

Operational Requirements: Any hybrid block/file configuration offered must still completely satisfy all functional objectives outlined in the SOO:

a. Deliver a minimum of 50 TB of net usable storage capacity on Day 1, with the architecture capable of scaling to 100 TB in the future.

b. Meet all physical and logical high-availability (HA) and disaster recovery (DR) requirements.

c. Ensure the end-user workstation access method remains completely unchanged (utilizing standard

Windows-compatible SMB/CIFS network paths over standard 10GbE network interfaces).

d. Provide administrators with cohesive, direct GUI-based visibility to manage the storage arrays, volume allocations, active directory permissions, and file systems.

18. What is meant by “independent archival capability”? (Backup repository, immutable storage, tape, object storage, etc.)?

Answer: Operational Definition: For this requirement, "independent archival capability" refers to the system’s ability to create, store, and isolate historical points-in-time (snapshots/backups) of active data that are physically or logically separated from the active production storage pool.

Technical Parameters: Offerors must satisfy this objective by providing a solution that supports:

Budget Parameters: $175,000 to $275,000

a. Immutable Storage / Logical Air-Gapping: The ability to lock archived snapshots or backup repositories

(e.g., utilizing WORM - Write Once, Read Many configurations) so they cannot be modified, deleted, or encrypted by ransomware or unauthorized administrative actions over a user-defined retention period.

b. No Tape Required: The Government does not require a physical tape-library infrastructure for this acquisition. All archival and backup operations must be disk-based (or flash-based) within the offered storage arrays or backup repositories.

c. Local Execution: Because the system operates entirely within secure facility (SCIF), all archival mechanisms must execute locally on the offered hardware without relying on cloud-based or external off-site object storage

08/12/2026

19. What is the distance between the primary and secondary sites and what protocol is used to connect them?

Answer: Current Physical Distance: Both the primary production SAN and the secondary Disaster Recovery (DR)

SAN will reside within the rack

Connectivity Protocol: Connected via standard local area network routing over 10GbE IP/iSCSI.

Future Relocation Design (Asynchronous Standard): While the physical distance is currently localized, the replication software and hardware configuration must be designed and licensed as an Asynchronous Replication model over standard IP. This ensures that the Government can physically relocate the DR SAN to another facility on base in the future (over greater geographic distance) without requiring any architectural changes, re-licensing, or performance degradation.

20. As our responsibility would be to migrate the existing environment from the three HPE MSA 2050 arrays to the new storage environment. How much data is actually being migrated?

Answer: Primary Data Migration Volume: The contractor is responsible for migrating approximately 28 TB of active production data from the legacy primary MSA 2050 SAN storage pool to the newly installed primary storage system.

Disaster Recovery (DR) SAN (No Legacy Migration): The contractor does not need to migrate the legacy historical backups to the new DR storage environment.

DR Seeding Requirement: The contractor shall configure the new backup/replication software on the new DR

SAN, and establish/seed a brand-new, clean baseline backup utilizing the active 28 TB production pool at the time of installation. Legacy historical backup retention will be handled internally by the Government.

21. What is the Network connectivity between sites, Bandwidth/latency?

Answer: Network Infrastructure: Because the primary and Disaster Recovery (DR) storage environments will reside in the same physical building, the connectivity between the two sites operates entirely over the secure local area network (LAN).

Bandwidth: The connection is a dedicated 10 Gigabit Ethernet (10GbE) network fabric.

Latency: The network latency between the primary and DR switch ports is near-zero (< 1 millisecond).

Cabling/Physical Layer: The LAN switch infrastructure supports both 10GBASE-T (RJ45 copper) and 10GbE

SFP+ (LC-to-LC fiber) connections. Offerors may utilize either interface type for replication traffic to match their offered hardware design.

Budget Parameters: $175,000 to $275,000

22. If the cost of this solution is beyond the specified price bracket defined, will this RFQ be cancelled?

Answer: The Government created the budget parameter from the Independent Government Estimate. As this requirement will be evaluated on comparative evaluation of all timely quotes, please review the solicitation for more information on the sam.gov solicitation webpage. The Government may not have the funds to support quotes that are above the budget parameter.

08/13/2026

23. SOO Section 3 and 4.a, What is the datatype of the data currently stored on / to be migrated to the SAN environment (e.g., structured database records, unstructured files, imagery/video, backups, etc.)? Primary reason for asking this determines whether the data is compressible and/or deduplicable, which directly affects the usable/effective capacity sizing of the offered 100TB (minimum) solution.

Answer: Data Profile Breakdown: The approximately 28 TB of active production data to be migrated consists of the following datatypes:

Unstructured Files & Office Documents: Standard office files (Word, Excel, PDFs, slides, and text files) which are highly compressible and deduplicable.

High-Resolution Imagery: A significant portion of the storage pool contains high-resolution imagery and system images. Offerors are advised that this portion of the data is already compressed at the file level and will exhibit low-to-minimal deduplication or compression ratios.

VMware User Profile Data: Contains VMware user profiles (registry hives, configuration archives, and personalization settings). This data is highly repetitive and exhibits excellent deduplication and compression ratios.

Data Sizing Mandate: To ensure the Government does not assume performance risk, all offered solutions must deliver the mandatory usable capacity baseline (minimum of 50TB on Day 1) as physical, formatted storage capacity before any data reduction (deduplication or compression) technologies are applied. "Effective capacity" calculations that rely on assumed deduplication ratios to reach the baseline will not be accepted to satisfy the minimum capacity requirement.

24. SOO Section 3 and 4.a, Is the data already encrypted or compressed at rest (e.g., existing SAN-level encryption, application-level encryption, or pre-compressed file formats)?

Answer: Data Compression Status: Yes, a significant portion of the active data pool consists of pre-compressed file formats (including high-resolution imagery and system images) which are already compressed at the application/file level. Standard user documents and VMware profiles are uncompressed.

Data Encryption Status: No, the data is not currently encrypted at rest at the SAN, host, or application level within the legacy HPE MSA 2050 environment.

New Encryption Requirement: Offerors are reminded that the replacement solution must natively support Data-at-Rest (DaR) encryption utilizing FIPS 140-2 (or FIPS 140-3) Level 2 validated Self-Encrypting Drives (SEDs) for all data volumes, which will be initialized and configured upon installation.

08/14/2026

25. What is the total size of the data that needs to be migrated?

Budget Parameters: $175,000 to $275,000

Answer: Primary Data Migration Volume: The contractor is responsible for migrating approximately 28 TB of active production data from the legacy primary storage pool to the newly installed primary storage system.

Disaster Recovery (DR) SAN (No Legacy Migration): The contractor is not responsible for migrating legacy historical backups. Instead, the contractor shall configure the new backup/replication software and seed a new baseline backup of the active 28 TB production data at the time of installation.

26. How much storage is allocated to each host, not counting replication, remote copy or snapshots?

Answer: Primary File Host Allocation: The entire active production storage volume (currently approximately 28

TB of active data) is allocated to a single (1) primary host server configured as the active Windows File Server.

Day 1 & Future Capacity Allocation: The replacement storage solution must deliver a minimum of 50TB of net usable capacity on Day 1 to this primary host server. However, the system must be capable of allocating and scaling up to 100TB of net usable capacity in the future (or distributed across multiple hosts/virtual machines as determined by the Government) over the life of the support contract simply by adding drives.

DR Host Allocation: The secondary Disaster Recovery (DR) host server is only allocated storage to serve as the target repository for backup and replication data.

27. How many hosts are attached to the arrays?

Answer: There are exactly two (2) physical host servers attached to the storage arrays across the entire environment:

One (1) Primary Host Server (located at the production site) attached to the primary storage system to serve as the active Windows File Server.

One (1) Disaster Recovery Site (DRS) Host Server (located at the DR site) attached to the secondary storage system to serve as the replication and backup target host.

Note: If an offeror offers a unified, all-in-one storage solution (where file sharing is hosted natively by the array controllers), zero (0) physical host servers may be attached, as the workstations would map directly to the unified storage array.

28. What OS(s) are in scope?

Answer: Workstation Clients (User Environment): The client workstations mapping the file shares run Microsoft

Windows 11.

Host/File Server (Admin Environment): The physical host servers provided under this contract are Windows-centric. The primary file server will run Microsoft Windows Server (current enterprise-supported version, e.g., Windows Server 2022, 2025, or equivalent).

Out of Scope OS: Linux-based host operating systems are out of scope for the primary file-sharing and administrative environments due to local training constraints.

29. What types of data (VMs, Images, Documents)?

Budget Parameters: $175,000 to $275,000

Answer: Data Profile: The data in scope consists of a mix of standard enterprise documents, spreadsheets, PDFs, slides, and large system image files.

High-Volume Imagery & Profiles: The storage pool hosts a significant volume of imagery files and VMware user profile data (profile archives/personalization settings).

30. For the snapshots, how often do you take a snapshot and what is the retention of the snapshot?

Answer: Snapshot Frequency: The primary production SAN must support an automated local snapshot schedule of one (1) snapshot taken daily (typically configured to execute after normal operational hours).

Snapshot Retention: Local snapshots must be retained for a rolling 30-day period.

Note: Offerors must factor the storage overhead required to retain 30 days of daily snapshots (based on your ~28

TB active data footprint and standard change rates) into their design to ensure the final formatted system still delivers the mandatory 50TB Day 1 net usable data storage capacity

31. How much growth is there of data?

Answer: Annual Growth Rate: Based on current usage trends, the Government’s active data pool is projected to grow at approximately 10% to 15% annually (reaching an estimated ~45TB of active data by the end of the 5-year support period).

Capacity Buffer: The updated 50TB net usable Day 1 baseline required by the Government is designed to naturally absorb all projected data growth, local snapshots, and formatting overhead. No physical hardware expansions or additional disk purchases are required of the contractor to support this growth baseline during the contract period.

Scalability: The offered storage chassis and controllers must support expansion up to 100TB of net usable capacity in the future simply by adding drives, without requiring a forklift upgrade or new controller heads.

32. There is a requirement for the selected item to be on the APL. The APL was sunset on 9/30/2025. Is an appliance with STIGs valid?

Answer: Yes. The Government acknowledges the sunset of the DISA DoDIN Approved Products List (APL)

In alignment with the current DoD transition to STIG-readiness and the DISA Risk Management Executive (RME) guidelines, an appliance/system that is fully STIG-compliant is completely acceptable and valid.

The solution offered must possess active, vendor-supported, or DISA-released Security Technical Implementation

Guides (STIGs). The contractor shall be responsible for fully implementing, hardening, and validating all applicable STIGs on the newly installed storage arrays, controllers, and host servers prior to final Government acceptance

33. Can you explain what the acceptance criteria is?

Answer: For the Government to accept the project (final acceptance) the contractor that is awarded the purchase order will have to meet all requirements outlined on the SOO. Please note this is separate form the evaluation of award outlined on the sam.gov solicitation webpage for this requirement.

Budget Parameters: $175,000 to $275,000

34. LEGACY MATERIAL DISPOSITION - SOO Section 2 states that "no legacy materials, components, or e-waste are authorized to leave the facility." SOO Section 5b states that the contractor "is responsible for the removal and off-base environmental disposition of all non-salvageable materials, packaging, and legacy e-waste, excluding any storage media governed by security mandates."; Please clarify which applies. Specifically: is the contractor to remove non-media material (packaging, rails, chassis, cabling) from the facility for off-base disposition, or is all material to be staged in place for Government disposition?

Answer: Waste vs. Legacy Hardware Disposition:

Commercial Packing Materials (Contractor Disposal): The contractor is responsible for the physical removal and off-base disposal of all non-security-related commercial shipping waste generated during the installation of the new hardware (such as cardboard boxes, shipping foam, wooden pallets, and plastic wrapping).

Legacy Electronics & Infrastructure (Government Retention): No legacy electronics, rack components, cabling, power cords, rails, or chassis are authorized to leave the secure facility. The contractor is responsible for the physical un-racking and clean teardown of the legacy SANs, management servers, rack rails, PDUs, and associated cabling. However, once un-racked, all of this legacy hardware and infrastructure material must be staged in-place at a designated location within the SCIF for final disposition and destruction by the Government.

2. Phased Installation and Migration Sequence (Zero-Downtime):

To ensure continuous operations and enable the migration of the active 28 TB of production data, the legacy storage environment and the new storage environment must remain racked, powered, and network-connected simultaneously during the migration phase. Offerors must not plan for any configuration that requires taking the legacy system offline prior to completing the data copy.

The contractor shall execute this transition utilizing a phased approach. Here is an example:

a. Phase 1 (Staging): The contractor shall physically mount and configure the new hardware in temporary

"swing space" (available open rack slots) within the same server room.

b. Phase 2 (Migration): The contractor shall connect both systems to the local network and execute the data migration from the legacy SAN to the new SAN.

c. Phase 3 (Cutover): Once the data transfer is verified, the contractor shall execute the logical cutover to the new system, transitioning active user access.

d. Phase 4 (Teardown & Final Placement): After the new system is verified fully operational, the contractor shall shut down and un-rack the legacy hardware (staging it for Government retention as described in

Part 1 above) and relocate the new hardware into the final desired rack location (the slots previously occupied by the legacy SAN) if temporary staging was required.

35. STORAGE MEDIA SANITISATION - Please confirm that sanitisation and final disposition of legacy storage media remain a Government responsibility, and that the contractor's obligation ends at un-racking and staging as directed by the Special Security Officer.

Answer: Yes, this is confirmed. The sanitization, declassification, physical destruction, and final disposition of all legacy storage media (hard drives, solid-state drives, and flash memory) is strictly and solely a Government responsibility.

The contractor is not authorized, required, or permitted to perform any data sanitization, degaussing, or physical destruction of classified media.

Boundary of Contractor Responsibility: The contractor’s physical and security obligations regarding all legacy storage media end immediately upon completing the physical un-racking, cataloging, and staging of the legacy

Budget Parameters: $175,000 to $275,000 equipment at the designated location within the secure facility, under the supervision of the local Special Security

Officer (SSO).

36. USABLE VERSUS RAW CAPACITY - SOO Section 4a requires "a minimum of 100TB Usable Total Storage distributed across three separate filers." Please confirm that 100TB is the usable figure after RAID protection and hot-spare allocation and confirm whether 100TB is required per filer or in aggregate across the three.

Answer: Aggregate Capacity: The requirement for a minimum of 50TB is in aggregate across the primary production environment on Day 1, not per individual storage array/chassis.

Net Usable Definition: This 50TB figure is a net usable baseline representing the actual formatted capacity available to the Government after accounting for RAID protection (minimum dual-drive failure tolerance), hot-spare disk allocations, and system formatting.

Scalability: The offered storage chassis and controllers must be capable of scaling up to 100TB of net usable capacity in the future simply by adding drives, without requiring a forklift upgrade or the purchase of new controller heads. The Disaster Recovery (DR) array must independently support the replication of this baseline.

Note: As clarified in previous responses, the primary production environment may consist of a single Active-

Active dual-controller storage array or two mirrored storage arrays to achieve the 50TB aggregate baseline.

37. CLEARANCE VERIFICATION LEAD TIME - SOO Section 6a requires all on-site personnel to hold an active

Secret clearance. Please advise the lead time the installation requires for clearance verification, visit authorization and unescorted access approval after award, so that the 30-day period of performance can be planned realistically against it.

Answer: No Unescorted Access: Unescorted access will not be granted under this contract. All contractor personnel performing on-site work inside the secure facility (SCIF) will be under continuous Government escort at all times.

Clearance Scope: As clarified in previous responses, an active Secret clearance is only required for technical personnel performing logical configuration, data migration, and administrative console training. Uncleared personnel (such as physical movers or chassis installers) are permitted on-site to perform heavy lifting and mounting tasks, subject to continuous Government escort and screen-masking protocols.

Security Processing Timeline: Immediately upon contract award, the contractor's security officer must coordinate directly with the Government unit's Special Security Officer (SSO) to submit DISS Visit Requests for all cleared personnel and submit base access requests for all uncleared personnel. This vetting process is expected to take approximately 10 to 14 calendar days.

30-Day Window Start Trigger: This administrative security lead time does not count against the contractor’s physical 30-day period of performance. The 30-day work clock will officially begin only after the physical hardware has been delivered on-site and the local SSO has fully approved the visit requests for the contractor's team.

38. MANAGEMENT SERVERS - The current environment includes an HPE ProLiant DL325 Gen10 and a DL360

Gen9 acting as management servers. Please confirm whether the Government intends these to be reused with the new filers, or whether replacement management servers are to be included in the offered solution.

Budget Parameters: $175,000 to $275,000

Answer: No Reuse of Legacy Hardware: The Government does not intend to reuse the legacy DL325 Gen10 or

DL360 Gen9 servers under this contract. All legacy hardware will be decommissioned.

Configuration Flexibility (Open Architecture): The Government is not restricting quotations to the legacy server-plus-SAN configuration. Offerors are encouraged to offer the most efficient, modern architecture.

//End of Question and Answers Document//

//Nothing Follows//