RFI QA SET 2 Conscription Simulation Model_2 of 3.pdf

Conscription Simulation Model RFI Questions – Part II

A. Scope, Use Cases, and Outcomes

The questions below help us scope the model to the Agency's intended decisions, audiences, and operational rhythm.

Scope, Use Cases, and Outcomes (Technical)

T-01 Who are the intended primary and secondary users of simulation -SSS Operations, SSS IT, OSD, USMEPCOM, OMB, Congressional staff, or others — and which of those audiences will exercise the model directly versus consume produced reports?

Why we ask: Direct-use audiences drive UI fidelity and access controls; report-only audiences shape the printable report format and statutory traceability requirements.

A1. The model will be operated exclusively by SSS personnel. Simulation outputs may be shared with other authorized Government agencies, when appropriate, to support strategic planning activities.

T-02 What is the cadence at which the model will be run in normal operations — continuously (always-on dashboards), monthly planning cycles, quarterly readiness reviews, or only during emergent contingency analysis?

Why we ask: Cadence determines the right balance between interactive sub-second runtime, batch overnight Monte Carlo, and operator-training depth.

A2. The model is expected to be executed on a monthly basis under normal conditions and on an as-needed basis for situational or contingency analyses.

T-03 Are there specific decision questions the Agency intends the model to answer first — for example, FY26 NDAA implementation impact, MEPS surge plan selection, staff activation timeline, or pre-positioning of mutual-aid contracts?

Why we ask: Knowing the first three to five decision questions lets us pre-load the platform with scenarios and dashboards designed to answer exactly those questions on Day 1.

A3. The Agency seeks the capability to evaluate resource requirements associated with targeted manpower routing and delivery scenarios.

T-04 Does the Agency intend the model to support post-event after-action reconstruction (replaying an actual mobilization day-by-day from real data) in addition to predictive forecasting?

Why we ask: After-action replay requires an explicit historical-data ingestion path;

predictive-only is a narrower scope. Both are supportable but they affect the data model.

A4. Yes, the model must support post-event after-action reconstruction in addition to predictive forecasting.

T-05 Is the model expected to support classified scenarios or classified parameters at any point in its lifecycle, or will all operational use remain at CUI/SBU and below?

Why we ask: Classification ceiling drives hosting choice, network enclave, personnel clearance requirements, and the scope of any future ATO package.

A5. The model will not incorporate classified scenarios or classified data. All operational use will remain at the unclassified level, and no Personally Identifiable Information (PII) will be processed.

T-06 Beyond the six MEFs, are there adjacent functions — e.g., Public Information, Registrant Services Center load, Alternative Service Employer matching, or Regional Office staffing — the Agency would like represented as future-phase modules?

Why we ask: Knowing the candidate Phase 2 modules lets us design the data model and API surface so they can be added without re-architecting.

A6. The scope is limited to the six Mission Essential Functions (MEFs), and no additional adjacent functions are required at this time.

T-07 Does the Agency have target throughput, fidelity, or runtime acceptance thresholds the model must meet (e.g., 'a 2M-inductee scenario must complete in under N seconds' or 'Monte Carlo of 1,000 replicates must complete within an analyst sitting')?

Why we ask: Explicit acceptance thresholds turn 'fast enough' into a measurable test the Government can grade us on.

A7. The Agency desires minimal model runtime and is open to vendor recommendations regarding appropriate performance parameters and runtime thresholds.

TECHNICAL QUESTIONS

Section B — Modeling Fidelity and Validation

Modeling Fidelity and Validation (Technical)

T-01 Will the Agency furnish authoritative reference values for key parameters — registration coverage by age, MEPS daily throughput by station, no-show rate, lost-notification rate, medical-DQ rate by mobilization posture, CO classification rate — or should the contractor propose defaults derived from public planning documents?

Why we ask: Government-furnished parameters dramatically shorten the validation cycle and give the model definitive provenance the Agency can defend before Congress.

A1. The Agency will furnish the authoritative parameters required to support the design and development of the model. Vendors are additionally expected to recommend supplemental or derived parameters necessary to enable comprehensive scenario analysis and comparative assessments.

T-02 What level of Validation, Verification, and Accreditation (VV&A) is expected — informal review by SSS subject-matter experts, formal documented VV&A under MIL- STD-3022 or DoDI 5000.61, or accreditation against a specific Agency or DoD standard?

Why we ask: VV&A scope drives both the schedule and the deliverable list; an MIL-STD- 3022 effort is materially larger than an internal SME review.

A2. The Agency does not require compliance with MIL-STD-3022, DoDI 5000.61, or any other Department of War validation, verification, and accreditation standards. All verification and validation activities will be performed internally and certified by SSS subject-matter experts. External accreditation is not required.

T-03 Is there a designated Subject-Matter Authority within SSS (or a partner agency such as USMEPCOM) whose written endorsement of the model's mechanics constitutes Agency validation?

Why we ask: Identifying the validating authority up front prevents downstream stakeholder churn and keeps validation within the planned schedule.

A3. Model validation will be executed internally by the Contracting Officer’s Representative (COR) and SSS leadership.

T-04 Are there any prior modeling efforts — internal SSS, FFRDC (e.g., RAND, IDA), or contractor — whose results the Agency expects this model to be benchmarked against?

Why we ask: Benchmarking against an authoritative prior model is the single most effective way to demonstrate fidelity to the Agency and to outside reviewers.

A4. No prior modeling efforts are designated for benchmarking. This represents a new requirement for the Agency.

T-05 What time granularity does the Agency expect — daily-bucketed (sufficient for the statutory deadlines, runs in milliseconds), hourly, or shift-level — and is per-registrant micro-simulation in scope or explicitly out of scope?

Why we ask: Granularity drives compute cost, data volume, and the analytical methods that are tractable. Daily granularity is our recommendation; we want to confirm.

A5. The model is expected to operate at daily granularity. Per-registrant micro-simulation is out of scope.

T-06 Should the model represent stochastic uncertainty natively (Monte Carlo replication with parameter noise) as part of the baseline scope, or is that a follow-on enhancement?

Why we ask: We have already implemented Monte Carlo replication with seedable RNG and variance decomposition. Confirming it is in baseline scope ensures it is not stripped out by a downselect.

A6. Yes, the model must incorporate stochastic uncertainty, including the use of Monte Carlo methods or equivalent techniques.

T-07 Are there specific MSSA outcomes — beyond Day 183, Day 193, and Day 210 — that the Agency considers statutorily binding and therefore must be first-class outputs of every run?

Why we ask: Anything statutory must be persisted alongside each run as a top-level KPI, not derived after the fact, so we want to capture the complete list.

A7. The Military Selective Service Act (MSSA) does not impose specific statutorily binding scenario outcomes relevant to the proposed tool. However, the current Department of War requirement to deliver 100,000 inductees within a 17-day window between Days 193 and 210 following mobilizations must be represented. The model must also support multiple configurable scenarios to evaluate varying operational conditions.

T-08 Does the Agency expect explicit modeling of CO and Alternative Service flows as a yield reducing diversion, an in-service substitution, or both?

Why we ask: The choice changes how the Alternative Service MEF interacts with the inducted-quantity target and the medical-DQ filter.

A8. The Agency requires the model to represent conscientious objector (CO) identification and routing into the Alternative Service Program (ASP) as a distinct process with associated operational and resource impacts. ASP participants should be treated as not inducted into military service. Therefore, CO and ASP flows must be modeled as yield-reducing diversions rather than in-service manpower substitutions.

T-09 How should the model treat mobilization-related policy levers that are statutory but not currently in force (e.g., women-in-the-draft expansion, expanded conscientious-objector criteria) — represented as configurable toggles, modeled only on Agency request, or excluded?

Why we ask: Including dormant policy levers as toggles lets the Agency answer 'what if Congress changes the law' without re-engineering the model.

A9. Dormant or proposed policy levers must be represented as configurable toggles. The model must be capable of executing multiple adjustable scenarios to assess a range of potential policy conditions.

Section C — Data, Integrations, Hosting

Data, Integrations, and Hosting (Technical)

T-01 What is the Agency's preferred hosting environment — SSS-operated on-premise, an SSS-controlled FedRAMP Moderate (or High) commercial cloud, a shared services environment such as GSA's Cloud.gov, or a partner-agency enclave?

Why we ask: Hosting choice cascades into the security posture, network topology, ATO package scope, deployment automation, and cost model.

A1. The model will be hosted within SSS information technology environments and operated by SSS personnel. The vendor will conduct development and testing within an SSS-designated cloud development environment in accordance with Agency information technology and security requirements.

T-02 Should the model integrate with — or merely export to — adjacent SSS systems such as the Registrant Information Management System (RIMS), the SSS data warehouse, or partner USMEPCOM systems? If integration is expected, what protocols are preferred (REST, message bus, file drop, etc.)?

Why we ask: 'Integrate' and 'export' are very different scopes — one is a contract change, the other is a CSV button.

A2. The model will operate as a stand-alone application and will not integrate directly with other SSS or partner systems.

T-03 Is there Government-Furnished Information (GFI) the Agency intends to provide — historical registration data, MEPS throughput data, prior mobilization exercises, or

NDAA implementation projections — that should be reflected in our scope and schedule assumptions?

Why we ask: GFI quality and timeliness materially affect when the validation phase can complete.

A3. The Agency will provide the data elements required to support the design and development of the model. Vendors are also expected to identify and recommend supplemental or derived data necessary to enable comprehensive scenario analysis and comparative modeling.

T-04 What identity/access management framework should the model integrate with — SSS Active Directory, USAccess (PIV), Login.gov, or a stand-alone account model bridged via SAML/OIDC to an SSS IdP?

Why we ask: IAM choice drives the auth subsystem, session management, and the user-onboarding path for SSS analysts.

A4. As a stand-alone application, the model will integrate with Microsoft Entra ID for identity and access management, using SAML 2.0 as the primary federation protocol.

T-05 Is multi-tenancy expected (e.g., separate SSS Operations, Office of IT, and partner agency tenants) or single-tenant only?

Why we ask: Multi-tenancy affects data partitioning and authorization; building it in from the start is cheaper than retrofitting.

A5. The solution is expected to operate within a single-tenant environment.

T-06 What data-retention, archival, and records-management requirements apply to scenario configurations, simulation runs, and reports — NARA records schedule, Agency-specific schedule, or to be defined?

Why we ask: Records retention drives storage architecture and export tooling for transfer to NARA at end of life.

A6. Pending completion of an Agency-specific records schedule currently under development, NARA General Records Schedules govern by default. System configuration files and simulation run records are expected to fall within GRS 3.1 (General Technology Management Records). Analytical reports and decision products will be covered under an Agency-specific schedule. Export tooling shall support NARA-approved electronic transfer formats per 36 CFR 1236. Final retention periods and transfer specifications will be provided in the RFQ.

T-07 What is the Agency's expectation for disaster recovery and business continuity — RPO/RTO targets, hot/warm/cold standby, geographic distribution?

Why we ask: DR posture is a hosting and cost driver and should be set explicitly rather than inferred.

A7. Regular database backups, combined with the capability to recreate the system using Infrastructure-as-Code and pipeline builds / deployments, will be sufficient to meet the Agency’s disaster recovery and business continuity requirements.

T-08 Are there Agency-mandated data-export formats (CSV, JSON, Parquet, XML) or downstream tooling (Tableau, Power BI, Excel, an SSS data lake) the model must produce output compatible with?

Why we ask: Native export to the Agency's analytical stack is much cheaper if designed in than bolted on.

A8. The model must support exporting outputs in formats compatible with the Agency’s analytical workflows, including Excel, Power BI, PDF, and CSV.

Section D — Security, ATO, Compliance

Security, ATO, and Compliance (Technical)

T-01 Is the deliverable expected to carry an Authority to Operate (ATO) at award, or is the Agency willing to begin operations under an Interim Authority to Test (IATT) and complete the ATO post-award?

Why we ask: ATO-at-award is a substantially longer schedule and a different cost structure than IATT-then-ATO.

A1. The Agency is willing to operate under an Interim Authority to Test, provided that all applicable compliance requirements are consistently implemented and maintained throughout the testing period.

T-02 What is the target Federal Information Processing Standard (FIPS-199) impact level for the system — Low, Moderate, or High — and is FedRAMP authorization required for the underlying cloud infrastructure?

Why we ask: Impact level governs the NIST 800-53 control baseline and the scope of the System Security Plan.

A2: The system will operate at the FISMA Moderate impact level. It will be hosted on SSS information technology infrastructure and operated by SSS personnel. The vendor will develop and test the tool within an SSS-designated development environment that complies with Agency information technology and security requirements.

T-03 Will the system process Personally Identifiable Information (PII) such as registrant SSNs, addresses, or selective-service numbers — or only anonymized aggregates and derived statistics?

Why we ask: PII handling triggers Privacy Act, PIA, SORN, and additional NIST 800-53 control families. Confirming scope avoids accidental over- or under-engineering.

A3. The system will process only anonymized aggregates and derived statistical outputs.

No Personally Identifiable Information (PII) will be ingested or stored within the model.

T-04 Does the Agency require an SBOM (Software Bill of Materials) per EO 14028 in

CycloneDX or SPDX format, and at what cadence — at delivery only or with every release?

Why we ask: Voric Group can produce CycloneDX SBOMs at every CI build. Confirming the format and cadence allows us to wire it into the pipeline from Day 1.

A4. An SBOM, produced in accordance with Executive Order 14028, is required at the time of delivery only.

T-05 What static analysis (SAST), software composition analysis (SCA), and dynamic analysis (DAST) tools or scan reports does the Agency require with delivery — Fortify, Veracode, Anchore, Trivy, Sonatype, etc.?

Why we ask: Tool alignment ensures the contractor's CI output is directly consumable by SSS Information Security without rework.

A5. The Agency requires that both static application security testing (SAST) and dynamic application security testing (DAST) be performed. While SSS uses Veracode internally, equivalent vendor-recommended tools are acceptable.

T-06 Are there Agency-mandated cryptographic standards beyond FIPS 140-3 — e.g., specific TLS profiles, FIPS-validated database TDE, CMVP-certified libraries?

Why we ask: Crypto stack selection is locked in early; changing it post-build is invasive.

A6. The Agency does not impose cryptographic requirements beyond those outlined in FIPS 140-3.

T-07 What audit logging standard applies — DoD STIG, NIST SP 800-92, an SSS-specific log retention policy — and is integration with an SSS-operated SIEM (Splunk, Elastic, Sentinel) required?

Why we ask: Log format, retention, and shipping target affect both the application logger and the deployment topology.

A7. Audit logging must comply with the requirements established in OMB Memorandum M-21-31. All logs will be forwarded to and ingested by the Agency’s SIEM platform.

T-08 Are vendor employees required to hold any specific clearance — Public Trust, Secret, or higher — at the time of award?

Why we ask: Clearance lead time can dominate the schedule; if cleared personnel are required, knowing now lets us mobilize the right team.

A8. Vendor personnel are required to hold a Public Trust clearance at the time of award.

Section E — Source Code, IP, Sustainment

Source Code, IP, and Sustainment (Technical)

T-01 What rights in technical data and software does the Agency expect — Government Purpose Rights, Unlimited Rights, or rights tailored under DFARS 252.227- 7013/7014 (or FAR 52.227-14 if a civilian-agency contract)?

Why we ask: This company can deliver under any of these regimes, but the cost and the open-source-component composition can be tuned to the chosen rights basis.

A1. The Government requires full and unrestricted delivery of all technical artifacts, including all source code, build pipelines and instructions, database schemas, infrastructure configuration files, and all other materials necessary to compile, deploy, operate, and maintain the system.

T-02 Should the source code be delivered to an SSS-operated source repository, GitHub.gov / code.gov, both, or a different destination of the Agency's choosing?

Why we ask: Repository choice affects the delivery automation, the access-control model, and the issue-tracking integration.

A2. The source code will be developed and tested within an SSS-designated cloud development environment in accordance with Agency information technology and security requirements.

T-03 Will the Agency permit the use of permissively licensed open-source components (MIT, Apache 2.0, BSD, ISC) in the runtime, and are any specific licenses (GPL, AGPL, SSPL) prohibited?

Why we ask: Our recommended stack is entirely permissively licensed and contains no copyleft components, but we want this confirmed in writing.

A3. All open-source components used within the system must comply with the requirements established under OMB Memorandum M-16-21.

T-04 Does the Agency require an SBOM-driven supply-chain attestation (e.g., SLSA Level 3+) at the build pipeline, or is component-level provenance sufficient?

Why we ask: SLSA L3+ requires hardened build infrastructure and is meaningful additional engineering scope.

A4. The Agency requires only the SBOM-based supply-chain attestations mandated under Executive Order 14028.

T-05 What is the Agency's expectation for documentation deliverables — operator runbook, administrator runbook, developer guide, validation plan, test report, ATO package, training materials — and at what level of formality?

Why we ask: Documentation scope is a meaningful portion of the deliverable cost and should be set explicitly.

A5. All documentation deliverables listed—such as operator and administrator runbooks, developer guides, validation plans, test reports, ATO documentation, and training materials—must be provided at a level of detail sufficient for the Agency to independently maintain, operate, and modify the system without contractor involvement.

T-06 Is post-award sustainment expected to be performed by the Agency, by the contractor under a sustainment contract or BPA, or by a third-party support provider?

Why we ask: Sustainment ownership shapes the documentation depth, the training plan, and the exit-transition plan.

A6. Post-award sustainment activities will be performed by the Agency.

T-07 What is the Agency's preferred mechanism for sustainment — fixed-price annual subscription with defined SLAs, time-and-materials with a not-to-exceed ceiling, or pay per-incident?

Why we ask: Each model has different overhead and risk allocation; the Agency's preference will shape our pricing posture for any follow-on RFP.

A7. As sustainment responsibilities will rest with the Agency, no contractor-based sustainment mechanism is anticipated at this time.

NON-TECHNICAL QUESTIONS

Section F — Acquisition, Schedule, Award

Acquisition, Schedule, and Award (Non-Technical)

N-01 Does the Agency anticipate a follow-on RFP or RFQ, or is direct award via an existing contract vehicle (GSA MAS, NASA SEWP, GSA Alliant 2, NITAAC CIO-SP3, an OASIS+ pool, or an SSS BPA) being considered?

Why we ask: Vehicle choice determines the proposal format and timeline; teaming arrangements can be lined up only when the vehicle is known.

A1. This requirement is new. The Government anticipates issuing an RFQ on SAM.gov.

N-02 Is a small-business set-aside, 8(a) sole-source, SDVOSB, WOSB, or HUBZone preference contemplated for the follow-on action?

Why we ask: Set-aside posture determines whether our agency competes as a prime, as a subcontractor to a small business prime, or under a teaming arrangement.

A2. Any set-aside determination will depend on the information the Agency receives through the RFI process.

N-03 What contract type does the Agency anticipate — Firm Fixed Price (FFP), Time &

Materials (T&M), Cost-Plus-Fixed-Fee (CPFF), or a hybrid (e.g., FFP for stand-up plus

T&M for sustainment)?

Why we ask: Contract type drives how we structure the price proposal and how risk is allocated between the parties.

A3. The Agency anticipates using an FFP contract structure.

N-04 Is there a target award date and a target Initial Operating Capability date the Agency would like the offeror to plan against?

Why we ask: Two anchor dates let us back-plan the proposal, mobilization, and stand-up activities credibly rather than speculatively.

A4. Target award and Initial Operating Capability dates will be provided in the forthcoming

RFQ.

N-05 What is the anticipated period of performance for the base period and any option periods?

Why we ask: Period of performance shapes the staffing model, the sustainment cost estimate, and the option-year ramp.

A5. The Agency typically employs a base-year period of performance with one or more option years; however, final period-of-performance details will be defined in the RFQ based on requirement specifics.

N-06 Without disclosing budget, is there a Rough Order of Magnitude (ROM) range the

Agency considers reasonable for this effort, or specific cost-realism criteria the Agency intends to apply?

Why we ask: A ROM band lets vendors right-size the proposed solution rather than over- or under-scoping it.

A6. The Agency is not providing a ROM at this time and is using the RFI to gather additional information from industry.

N-07 Will the Agency accept commercial item solutions under FAR Part 12, and would a COTS derived offering with Government-tailored configuration meet the Agency's definition of 'government-owned'?

Why we ask: The SSS SIM-NET platform is a commercial offering by origin but is delivered with full source and Government rights; we want to confirm that meets the Agency's intent.

A7. The Agency is seeking a commercial solution for this requirement.

N-08 What past-performance criteria (relevance, recency, dollar value, cleared/uncleared, federal/civilian) does the Agency intend to weight, and how many reference projects will be required?

Why we ask: Past performance is often the largest evaluation factor; knowing the criteria lets us select the strongest references.

A8. Because this is an RFI, past-performance evaluation criteria are not yet available.

Specific criteria will be included in the RFQ.

N-09 Will the Agency consider a phased award — e.g., a small validation/pilot task order followed by a production task order — to reduce procurement risk on both sides?

Why we ask: A pilot-then-production structure is often the lowest-risk path for both the Agency and the offeror, and we can scope to it if useful.

A9. The Agency may consider a phased award approach—such as a pilot task order followed by production—if doing so provides added value to the Government.

Section G — Industry Engagement and Process

Industry Engagement and Process (Non-Technical)

N-01 Does the Agency intend to host an Industry Day, a pre-proposal conference, or one-on one capability briefings prior to issuing a follow-on solicitation?

Why we ask: Industry engagement events are the most efficient way to align vendor offerings with Agency intent and to surface evaluation criteria early.

A1. The Agency is open to all engagement formats, including an Industry Day, a pre-proposal conference, and one-on-one capability briefings.

N-02 Will the Agency accept live demonstrations of operational capability from interested vendors, and if so, in what format — virtual, on-site at SSS National Headquarters, or both?

Why we ask: This agency has an operating platform that can be demonstrated at no cost to the Agency. We want to know how the Agency would prefer to receive that.

A2. The Agency is open to receiving live demonstrations from interested vendors. The preferred format for such demonstrations is virtual.

N-03 Will responses to vendor questions be published in an amendment to the SAM.gov posting, distributed bilaterally, or made available only to those who attend an Industry Day?

Why we ask: Publication channel determines whether all vendors compete on equal information.

A3. Responses to vendor questions will be published on SAM.gov under the posted requirement, ensuring all interested and registered vendors have equal access to the information.

N-04 Is the Agency seeking white-paper or capability-statement submissions in addition to, or in place of, RFI responses?

Why we ask: Multiple intake paths let vendors tailor their submission to the Agency's preferred medium.

A4. The Agency is seeking responses to the questions included in this RFI.

N-05 Are there prime/teaming arrangements the Agency expects to be, for example, a hosting prime (cloud-service provider) plus a modeling sub, or a single integrator delivering end to-end?

Why we ask: Teaming structure shapes our partner outreach and the legal vehicles we need to put in place before any follow-on proposal date.

A5. The Agency is not considering teaming arrangements at this time.

N-06 Is the Agency open to a Cooperative Research and Development Agreement (CRADA), Other Transaction Authority (OTA), Small Business Innovation Research (SBIR), or Commercial Solutions Opening (CSO) instrument as an alternative to a traditional FAR based contract?

Why we ask: Non-traditional vehicles can compress schedule materially when the capability is already commercial and the Agency is willing to use them.

A6. The Agency intends to follow the Federal Acquisition Regulation and the Administration’s emphasis on acquiring commercial products and services.

N-07 What is the preferred mechanism for ongoing communication during the market research phase — written Q&A, scheduled phone calls, virtual capability briefings, or a single point of contact?

Why we ask: Setting the channel up front avoids inadvertent perceived advantage and keeps the contracting officer in the loop.

A7. No ongoing communication is occurring during this RFI phase. Any individual inquiries received by the Agency point of contact must be disclosed to the contracting officer to ensure compliance with federal procurement integrity requirements. All questions and answers will be posted publicly for vendor visibility. Written Q&A is the only authorized communication method until the solicitation phase.

N-08 Does the Agency intend to incorporate any Section 508 / accessibility, environmental sustainability, or American-made-software preferences into the follow-on evaluation?

Why we ask: These factors can be designed into the offering at low marginal cost if known early.

A8. The follow-on evaluation will require adherence to federal Section 508 accessibility standards, applicable government-wide environmental sustainability requirements, and domestic sourcing requirements consistent with the President’s Management Agenda.