DOD Cloud: Request for Information

The DOD Cloud RFI is amended in response to an RFI inquiry: The DoD Enterprise Cloud Acquisition is a new requirement with no incumbent or assigned solicitation number at this time. Please see the attached memorandum from the Deputy Secretary of Defense for details regarding this initiative. REQUEST FOR INFORMATION The Department of Defense (DoD) Cloud Executive Steering Group (CESG) is seeking information related to the initiative recently established by Deputy Secretary of Defense Patrick Shanahan to accelerate enterprise cloud adoption. DoD is seeking targeted industry input on how to best approach and structure the planned solicitation to acquire a modern enterprise cloud services solution that can support unclassified, secret, and top secret information in CONUS and OCONUS environments. This effort is being done in an aggressive, yet rigorous manner to ensure the Department realizes the operational advantages of cloud infrastructure and platform services as quickly as possible. The Department recognizes the value of technical voices from industry and encourages those voices to be at the forefront in responding to this Request for Information (RFI). Cloud Acquisition Considerations Below are some considerations to help industry best respond to this RFI: 1. This is an acquisition for Infrastructure as a Service (IaaS) and Platform as a Service (PaaS). This requirement does not include Software as a Service (SaaS). 2. The tactical edge and delivering services to the warfighter matter. The required cloud services must extend from the homefront to the tactical edge, to include austere and connectivity/communication deprived environments, and be able to support closed loop networks supporting warfighting operations. 3. This acquisition will require services in CONUS and OCONUS locations at all classification levels. 4. DoD is seeking technical parity with commercial cloud, even if private or hybrid cloud services are part of the final solution. 5. DoD is seeking to capitalize and rely on the services and expertise of the cloud provider(s) to the greatest extent possible to include management of facilities and infrastructure at higher classification levels. 6. DoD is prepared to pursue the revision of existing policies and federal regulations remove barriers to success. Revisions are not guaranteed and will require the balancing of many factors, including security and reliability. 7. DoD is seeking firm-fixed (i.e., catalogue) prices for all services under this indefinite delivery/indefinite quantity contract. 8. DoD is considering in-depth technical analysis of the current environment, cloud migration support, change management, and training services to be within scope of this contract. 9. A contract award is planned for fiscal year 2018. Questions for RFI Respondents Given the considerations set forth above, DoD is seeking targeted feedback from potential cloud providers and other vendors with relevant information for the following questions broken out by subject area. Partial responses are acceptable although complete responses to all questions are preferred understanding that some questions may be inapplicable to your company depending on the kinds of offerings you provide. I. Lessons Learned 1. For large customers with a worldwide presence, what kind of personnel resources internal to the customer do you recommend be available to facilitate and support workload migrations? What kind of enterprise program office structure and governance oversight would you recommend based on your experience? 2. What are the main factors that contribute to system migration failure from your experience? How can those risks be mitigated? 3. What kind of customer processes or behaviors have you found essential to enable the optimization of using cloud infrastructure? 4. What internal support structures and resources would you recommend for an organization that wishes to capitalize on the sharing of data across the cloud in order to support data-driven decision making and big data analysis? 5. In your experience, what are the key factors to securing information in an enterprise cloud infrastructure? What are the primary risks to mitigate in this environment? II. Pricing and Services 1. Please describe and provide information about your typical pricing structure for IaaS and/or PaaS. a. What kind of fixed price pricing structure would you recommend DoD use for this solicitation? What kind of CLIN structure would you recommend? Please provide an example or commercial pricing list/structure as part of your response. DoD is interested in a utility-based model based on usage paid in arrears. 2. Please describe in detail the services that comprise your IaaS, PaaS, and/or other relevant offerings. Explain and diagram the infrastructure architecture in detail. Additionally: a. If you provide cloud migration support as part of your IaaS/PaaS offerings, please describe in detail the scope of those services, how many employees you have that provide this service (distinguishing between direct employees and subcontractors), and where additional services from another vendor may be required to successfully migrate a system workload. i. Explain how you would recommend cloud migration support be provided in OCONUS garrison environments. b. Please notate and explain any services that are available to your private sector customers, but are not currently available to the Federal government, and explain why. c. Please describe to what degree your PaaS offerings are able to run on other provider's infrastructure. In answering this question, identify which offerings are vendor agnostic for infrastructure and also identify which offerings are limited to certain infrastructure providers. i. For cloud service providers that support third party PaaS offerings, describe what kind of pricing and billing structures are available. Describe how your third party marketplace works and explain whether the third party offerings are typically ordered from the cloud service provider directly or from the third party provider. Describe how clients are able to direct which third party offerings to incorporate into the marketplace. d. Please describe how your IaaS/PaaS offerings provide for the security of information, including threat detection, mitigation, and containment. e. Please describe your failover and data replication architecture and service offerings. How would you handle a requirement for resiliency/reliability for a solution at the tactical edge or a hybrid commercial/on-premise solution? f. How do your offerings provide for sharing of data across network boundaries, including up classification levels and outside of your IaaS/PaaS services (across other cloud provider's environments)? 3. What information or attributes are required for you to accurately provide pricing information on a fixed-price basis for worldwide DoD IaaS/PaaS at all classification levels? 4. Do you have established discount methodologies, e.g., discount percentages based on reserving virtual instances? If so, please describe. III. Tactical Edge 1. Please describe if and how you could provide IaaS/PaaS in austere and connectivity/communication deprived environments. Explain and diagram the infrastructure architecture in detail, including the use of ruggedized, portable equipment that could be forward deployed and moved within hours of notice. a. If you have existing customers using such services, please describe and provide point of contact information, if possible. 2. Please describe if and how you could extend IaaS/PaaS into a closed loop network where contractors may not be permitted to manage the facilities. 3. Please describe your hybrid commercial and/or on-premise solution and architecture. How would you handle an installation at the edge of connectivity, including service initiation and eventual syncing back to installations in garrison? IV. Existing Cloud Presence 1. Please describe your current cloud presence in the Federal government for workloads that are classified at Secret or above, if any. For instance, which agency, describe the technology solution, explain if the cloud services are limited to a specific geographic region, explain who maintains the facility and computing infrastructure, etc. Do not provide any classified information in this response. 2. Please describe your current on premise private cloud presence in the Federal government, if any. For instance, which agency, describe the technology solution, describe any limitations in achieving technical parity with commercial cloud, identify the classification level, explain who maintains the facility and computing infrastructure, etc. Do not provide any classified information in this response. 3. Please describe at least one example of a large commercial customer with worldwide presence that has migrated to your infrastructure and platform services and provide point of contact information, if possible. V. Policy and Regulatory Barriers 1. Please identify any policies or federal regulations that are barriers to success, explain why those policies or regulations are barriers, and propose revisions or an alternative that still achieves the underlying policy or regulatory objective. Specific suggestions with proposed language revisions are preferred rather than more generalized comments. Instructions for Submission RFI respondents are encouraged to provide responses to the questions above. Responses may inform the future enterprise cloud solicitation. The CESG requests that responses to the RFI be submitted by 17 November 2017 by 1400 Eastern Time. All submissions must be submitted via email to dod-cloud-responses@dds.mil in a searchable format (e.g., not scanned). No verbal responses will be accepted. Proprietary information may be submitted; however, RFI respondents are responsible for adequately marking proprietary, restricted, or competition sensitive information contained in their response. All submissions will be protected from disclosure outside of the DoD to the maximum extent possible under Federal laws. Only unclassified responses will be accepted. Do not submit classified information. In addition, RFI respondents should be aware that the CESG may utilize contractor support personnel from the below listed companies (under existing contracts) to review responses submitted. These companies and individual employees are bound contractually by Organizational Conflict of Interest and non-disclosure clauses with respect to proprietary information, and they will take all reasonable action necessary to preclude unauthorized use or disclosure of an RFI respondent's proprietary data. By submitting an RFI response, the respondent's company is agreeing to the disclosure of its RFI response to the following support contractors. If permission is not granted, the RFI response must clearly state that permission is denied. - Suntiva - The MITRE Corporation - Institute for Defense Analyses (IDA) This RFI is not a solicitation. This RFI is for planning purposes only. It does not constitute a solicitation or a promise to issue a solicitation in the future. This RFI does not commit the Government to contract for any supply or service whatsoever. Further, DoD is not seeking proposals at this time, and will not accept unsolicited proposals. Respondents are advised that the Government will not pay for any information or administrative costs incurred in response to this RFI. All costs associated with responding to this RFI will be solely at the responding party's expense. Participation is not mandatory or required; participation or response to this RFI is not a prerequisite for any future procurement activities. If you have any questions about the instructions for submission, email your questions to dod-cloud-responses@dds.mil with the word "Question" in the subject line.