login.gov engineering services

This is a request for information notice only. This is not a request for an offer or proposals. This notice does not represent a commitment by the government to issue a solicitation or award a contract. Information received will be used to determine the availability of technically capable and otherwise responsible firms that would be interested in submitting offers. 1.0 Summary of goal The U.S. General Services Administration (GSA), Federal Acquisition Service (FAS), Technology Transformation Services (TTS) Division is conducting a market survey and is seeking qualified large or small business firms (including small disadvantaged businesses such as Certified HUBZone, 8(a), Service-Disabled Veteran-Owned Small Business, and Women-Owned Small Business, etc.) to provide professional services in support of the login.gov platform. 2.0 About the login.gov platform login.gov offers the public secure and private online access to participating government programs. With one login.gov account, users can sign in to multiple government agencies. Our goal is to make managing federal benefits, services and applications easier and more secure. As part of this process, TTS is seeking information from vendors in order to determine which companies have the skills to support these efforts and how they would go about providing those services to the US federal government. Specifically, we are looking for companies who can satisfy the needs outlined below. Answering the following questions will help us understand the options available to us. 3.0 How we work 3.1 Our general practices login.gov uses DevOps practices and Infrastructure as Code principles for operations and maintenance. This work combines system administration and code development. Team members commit all changes to source control (git) and test and deploy them using continuous integration and continuous deployment tools. We work in a collaborative, remote-first environment, including chat and video call discussions of changes before, during, and after development, with frequent use of pairing between employees and contractors. 3.2 Our technical infrastructure login.gov is a federated single sign-on (SSO) solution that provides and supports simple and secure access to public-facing consumer services and information with mandatory use of multi-factor authentication (MFA), while ensuring protecting consumer privacy is a paramount factor in our decision making process. login.gov functions as an SSO service that will allow an individual to authenticate, but not authorize, their access to a partner agency's application. This is done through OpenID Connect (OIDC) or Security Assertion Markup Language (SAML). Note that we strongly prefer OIDC over SAML, but maintain support for SAML integrations due to the depth and breadth of its usage in the federal government. Our platform runs on top of Amazon Web Services (AWS) East/West, and is principally a Ruby on Rails application. 4.0 NAICS codes The North American Industry Classification System (NAICS) code for this procurement will be finalized once submissions resulting from this RFI have been analyzed. We anticipate that NAICS codes may include: 541511 -- Custom Computer Programming Services (Not Finalized) *vendors may suggest a NAICS code as well* 5.0 Objectives for technical services GSA intends to purchase professional services in order for the vendor to perform operations and maintenance for the login.gov technical system. Specifically, we are seeking a vendor who is familiar with the way we work (outlined in 3.0, above) and can meet the following objectives: * Be experts in the identity proofing space. * Be familiar with [LOA1 and LOA3](https://developers.login.gov/attributes/). * Be familiar with the NIST standards outlined in [800-63-3](https://pages.nist.gov/800-63-3/). * Be familiar with many of the following technologies: * [login.gov's codebase](https://github.com/18F/identity-idp) * [node.js](https://nodejs.org/en/) * [browserify](http://browserify.org/) * [zxcvbn](https://github.com/dropbox/zxcvbn) * [ElastiCache](https://aws.amazon.com/elasticache/) [Redis](https://aws.amazon.com/redis/) * [PostgreSQL](https://www.postgresql.org/) * [Jenkins](https://jenkins.io/) * [Secure Shell (SSH) 2.0](https://en.wikipedia.org/wiki/Secure_Shell) * [Chef](https://www.chef.io/) * [Virtual Private Cloud](https://aws.amazon.com/vpc/) * [Packer](https://www.packer.io/) * [Terraform](https://www.terraform.io/) * [Elasticsearch, Logstash, and Kibana](https://www.elastic.co/) * [Travis CI](https://travis-ci.org/) * [Code Climate](https://codeclimate.com/) * [Hakiri](https://hakiri.io/) * [Python](https://www.python.org/) * Understand what it means to be [agile](http://agilemanifesto.org/). * Be familiar with [Scrum](https://en.wikipedia.org/wiki/Scrum_(software_development)) methodologies. * Utilize your expertise to develop, test, and deploy features in an iterative fashion. * Be able to stand up virtual machine instances of distributed compute, storage, relational, and non-relational databases, data warehouses for business analytics, and content delivery networks. * Automate tasks as much as possible. * Maintain the highest standards of security and privacy. * Be able to comply with the security and privacy requirements that are unique to the federal government. * Maintain best practices as it relates to technical documentation, analytics, usage of AWS, and and Ruby code. * Ensure you have the ability to participate in a 24/7 staffing rotation for DevOps support. 6.0 Place of Performance and Hours The contractor shall perform the work off-site at their own workplaces. Contractor personnel should be available during normal business hours for US time zones. More details in relation to place of performance and hours will be established once the solicitation is released. 7.0 How to Respond Offerors capable of performing as a prime contractor that meet the requirements stated above are encouraged to complete this form: https://goo.gl/forms/XRHDY8IF3JCeu4zb2 Interested firms having the capabilities necessary to meet or exceed the stated requirements are encouraged to submit responses addressing each of the questions in the Google Form. All responses shall be submitted via the referenced Google Form above no later than 4:00 PM ET, January 4, 2018. Any additional questions may be submitted directly to Joseph Dorsey at joseph.dorsey@gsa.gov with a CC to richard2.williams@gsa.gov. Please reference "login.gov engineering support" in any email responses. 8.0 Contact information Primary point of contact: Name: Joseph Dorsey, Contracting Officer Email: joseph.dorsey@gsa.gov Phone: (303) 907-7293 Secondary point of contact: Name: Ricky Williams Email: Richard2.Williams@gsa.gov Phone: (202) 355-5023