AE Release (industry) JFHQ-C ISP Range - 2026-09-10 (SAM.GOV).docx

Notice ID ISP Cyber Range (JFHQ-C) Assessment Event Related Notice Department/Ind. Agency

DEPT OF DEFENSE

Sub-tier Department of the Army Office Army Contracting Command General Information

• Contract Opportunity Type: Special Notice (Original)

• All Dates/Times are: (UTC-05:00) EASTERN STANDARD TIME, NEW YORK, USA

• Original Published Date: September 10, 2026 3:30 pm EDT

• Original Response Date: October 13, 2026 11:59 pm EDT

• Inactive Policy: 1 day after the response date

• Original Inactive Date: October 14, 2026

• Initiative:

Classification

• Original Set Aside: N/A

• Classification Code: D -- Information Technology services, including telecommunications services NAICS Code: 541 -- Professional, Scientific, and Technical Services/541330 -- Engineering Services

• Place of Performance: Augusta, GA USA

ISP Cyber Range Assessment Event Submit a Whitepaper NLT 13 OCT 2026 at/before 11:59 PM ET U.S. Citizens Only

Purpose The Cyber Fusion Innovation Center (CFIC), in collaboration with Army Cyber Command (ARCYBER) and the Army Cyber Technology and Innovation Center (ArCTIC), invites qualified industry partners to submit proposals for the development of a high‑fidelity Internet Service Provider (ISP) Cyber Range. This Assessment Event release describes the problem set, desired capabilities, and evaluation approach for solutions that can support Joint Force Headquarters‑Cyber (JFHQ‑C) (A)’s mission to provide full-spectrum cyberspace operations (CO) in support of Combatant Command missions.

Background/Synopsis In FY26, ARCYBER identified the need to seek proposals from qualified vendors for the development and delivery of an advanced, scalable ISP network range to support JFHQ‑C (A)’s mission to provide full-spectrum cyberspace operations (CO) in support of Combatant Command missions. Adversaries increasingly target core internet and telecommunications infrastructure to establish covert footholds, compromise downstream customers, and posture for widespread communication disruptions. To better understand and mitigate these risks, JFHQ‑C (A) requires an environment to safely mock, map, and emulate adversary tactics within realistic ISP‑style network infrastructures The solution sought must allow operators to conduct highly interactive, complex missions spanning from top‑level Internet Exchange Points (IXPs) down to Customer Premises Equipment (CPE). To accelerate mission planning and execution, the platform must provide deep situational awareness through comprehensive traffic monitoring, granular device‑level debugging, and the ability to rapidly reset the infrastructure to a baseline state for subsequent testing iterations.

Operational Concept The initial Collaboration Event release did not define deployment and sustainment responsibilities therefore this Assessment Event establishes the following operational concept.

Hosting Context

· The ISP Cyber Range is expected to be hosted in a Government‑controlled, air‑gapped lab environment that will not have internet access. At a minimum, the environment will be operated at a Controlled Unclassified Information (CUI) level; use on higher classification enclaves (e.g., unclassified development networks such as Unclassified (U) or Top Secret (TS) development networks) will be determined by the Government and documented in follow‑on design and implementation artifacts

· Physical hardware (routers, BNGs/BRAS, OLTs/ONTs/ONUs, RF/microwave radios, timing/GNSS devices, switches) will reside in Government racks and be subject to Government physical access controls

· The Government will have direct access to all management interfaces (out‑of‑band networks, orchestration tools, telemetry platforms) Preferred Operating Model – Government-Operated with Vendor Build/Support The baseline assumption is:

· Vendors design, build, integrate, and document the ISP Cyber Range and train Government personnel

· Government personnel perform day‑to‑day operations

· Schedule and run test/training scenarios

· Execute adversary‑emulation missions

· Perform routine resets to baseline

· Monitor telemetry and logs

· Vendors provide ongoing engineering and support for:

· Hardware and NOS/firmware maintenance/upgrades

· Adding new scenarios, capabilities, and components

· Deep troubleshooting and enhancements Alternative Operating Models – Co-Managed / Managed Service The Government is also interested in options where:

· The vendor provides a co‑managed model:

· Vendor and Government share operational responsibilities

· Vendor may operate the underlying infrastructure, while Government focuses on mission design and execution

· Perform routine resets to baseline

· Monitor telemetry and logs

· The vendor provides a managed service model: Vendor operates the ISP range on behalf of the Government, subject to security/access constraints Respondents shall

· Assume an air‑gapped Government lab environment without direct internet connectivity

· State which operating model(s) they support (Government‑operated, co‑managed, managed service)

· Describe the division of responsibilities for:

· Initial deployment and integration

· Day‑to‑day operation

· Maintenance and upgrades

· Training and documentation

· Support and escalation The Government will make the final enclave decision (e.g., U or TS development networks) during follow‑on design, but respondents must demonstrate that their solution and support model are compatible with an air‑gapped, Government‑controlled environment.

Key Capabilities The proposed solution should meet the following requirements and deliver the corresponding key outcomes.

1. End‑to‑End Hybrid ISP Fabric: Provide a hybrid physical + virtual + emulated cloud environment that accurately represents an ISP fabric from Internet Exchange Points (IXPs) and transit providers through core/aggregation/backhaul to access networks and Customer Premises Equipment (CPE). This includes the ability to integrate and emulate key CSP services and infrastructure to simulate hybrid cloud deployments and cloud-native ISP components.

Key Outcomes

· Ability to model and operate:

· Peering/IXPs and transit (route servers, eBGP peers)

· Core and aggregation routers (MPLS/Segment Routing, OSPF/IS‑IS, BGP)

· Broadband Network Gateways (BNG/BRAS) terminating PPPoE/IPoE subscriber sessions

· Access networks (RF/microwave/WISP links and GPON/PON fiber trees)

· CPE/ONT/ONU devices with realistic management and behavior

· Emulated cloud service provider (CSP) environments and their integration with traditional ISP infrastructure

· Realistic network conditions, including configurable latency profiles to simulate geographic distances and network congestion

· Clear separation and interaction between:

· Control plane (routing/signaling)

· Data plane (forwarding ASICs, line cards)

· Physical layer (RF/optical)

· Management plane (AAA, TR‑069/CWMP, DNS, logging)

2. ISP-Specific Attack Surface Coverage (Adversary Emulation): Provide the ability, within the ISP Cyber Range, to safely emulate tactics, techniques, and procedures against carrier‑grade attack surfaces such as routing, signaling, access, and timing. This capability must extend beyond traditional host/domain endpoints Key Outcomes

· Support end‑to‑end scenarios involving:

· BGP hijacks and leaks; MPLS/Segment Routing misconfigurations

· PPPoE/IPoE subscriber session manipulation

· AAA attacks (RADIUS/Diameter, including Blast‑RADIUS‑class behaviors

· TR‑069/CWMP exploitation and mass CPE compromise

· DNS at resolver scale

· RF‑layer attacks (jamming, interference, deauthentication, over‑the‑air eavesdropping)

· GPON/PON attacks (rogue ONT/ONU, upstream jamming, OMCI abuse)

· Timing attacks (GPS spoofing/jamming, PTP/SyncE manipulation)

· Silicon/firmware vulnerabilities (e.g., Trust Anchor/FPGA class issues, line‑card crashes)

· Attacks against cloud-native services, hybrid cloud configurations, and the interfaces between traditional ISP infrastructure and emulated CSP environments

· Scenarios where network latency is a critical factor, allowing operators to assess the impact of geographic distribution on attack effectiveness and detection

· Provide mechanisms to deploy, observe, and reset these scenarios safely within the lab, without impact to production networks

3. Specialized Hardware and Physical Layer Fidelity: Use real carrier‑class hardware where behavior is inherently physical or silicon‑bound; virtual/emulated components alone are insufficient Key Outcomes

· Inclusion of at least:

· Core/aggregation/BNG routers/switches with real forwarding ASICs and line cards

· One or more OLTs with ONTs/ONUs and passive splitters to represent GPON/PON access

· RF/microwave radios to represent WISP/backhaul access

· GNSS/GPS‑disciplined timing hardware providing PTP/1588 and SyncE

· Demonstrable behavior that cannot be reproduced purely in software:

· Hardware‑only vulnerabilities and line‑card faults

· RF modulation changes, fade/interference effects

· GPON upstream burst mode, OMCI behavior, optical power budgets

· UTC‑traceable timing distribution with nanosecond‑level budgets

4. Scope and Scale (Routing, Sessions, CGNAT, Line Rate): The solution must demonstrate the ability to maintain realistic performance metrics (e.g., throughput, session stability) under various simulated latency conditions, reflecting geographically distributed network segments Key Outcomes

· Routing: Ability to handle BGP tables on the order of hundreds of thousands to ≈1,000,000+ routes

· Subscriber sessions and AAA: Logical support for tens of thousands to hundreds of thousands of concurrent PPPoE/IPoE sessions across BNGs (using a mix of physical and virtual components)

· CGNAT: Representation of carrier‑grade NAT behavior (e.g., ≈128 subscribers per public IP) and port constraints

· Line rate and throughput: Use of high‑speed interfaces (e.g., 10G/40G/100G, with higher speeds where feasible) and traffic generators to model realistic load patterns and saturation behaviors

· Respondents must clearly state the tested and practical limits of their proposed architecture.

5. Situational Awareness, Telemetry, and Debugging: Provide pervasive, integrated, and robust observability across the hybrid ISP fabric, including comprehensive logging of all network activities Key Outcomes

· Flow and routing visibility:

· IPFIX/NetFlow collectors across IXPs, core, and access. BMP or equivalent for BGP pre‑policy/post‑policy route monitoring

· BMP or equivalent for BGP pre‑policy/post‑policy route monitoring, along with detailed logging of BGP events

· Centralized logging and telemetry:

· Centralized, robust logging of all network activities, including Syslog/JSON logs from core/edge/BNG/OLT/ONT/RF devices, DNS query logs, AAA authentication logs, and other relevant network event logs

· gNMI/SNMP streaming telemetry for sub‑second interface and performance metrics

· Debugging and packet capture:

· Out‑of‑band management network with SSH/console access to hardware and virtual nodes

· PCAP capture at key boundaries (CPE WAN, BNG edges, IXP fabric, GPON uplinks)

· Mechanisms to correlate events across control, data, physical, and comprehensive log data during offensive tests

6. Rapid Reset and Orchestration (Baseline Management): Implement highly efficient, automated reset capabilities for both virtual and physical configurations Key Outcomes

· Ability to destroy and rebuild the full environment or specific enclaves to a known, clean baseline in a defined timeframe (e.g., under 30 minutes for virtual components, with repeatable processes for physical devices)

· Use of declarative configuration and infrastructure‑as‑code (e.g., Ansible, Terraform, GitOps) for:

· Baseline device configurations

· Virtual topology deployment (containers/VMs)

· Scenario deployment and tear‑down

· Integration with CI/CD pipelines (e.g., GitLab CI, GitHub Actions) to automate reset workflows and enable rapid iteration

7. Security, Isolation, and Safety: Ensure the ISP Cyber Range is strictly isolated from production networks and safe for aggressive testing Key Outcomes

· Strong isolation boundaries (physical and logical) preventing test traffic or malware from escaping

· Robust access control and auditing of operator/administrator actions

· Safe handling of adversary tools, malware, and exploit code in accordance with Government policies Deliverables The contractor shall provide the following deliverables:

1. A functional prototype of the ISP Cyber Range demonstrating the hybrid physical + virtual architecture and key ISP‑specific capabilities

2. Documentation, including:

· User manual

· Installation/configuration guides

· Architecture diagrams (ISP fabric and management/orchestration/telemetry planes)

· API/integration documentation for telemetry and orchestration

3. A detailed report outlining:

· Design and implementation of the hybrid architecture

· Interaction between physical components and virtual/emulated components

· Quantitative performance limits (routes, sessions, throughput, timing precision).

· Operational model (Government‑operated vs co‑managed/managed service, division of responsibilities)

4. A demonstration of the range’s capabilities and performance during the Virtual Assessment Event.

Whitepaper Submission Information Interested vendors are requested to submit a proposal through Vulcan that includes the following information:

· A detailed description of the proposed ISP Cyber Range architecture (physical, virtual, and emulated cloud components)

· A technical architecture diagram for:

· ISP fabric (peering/core/aggregation/access/CPE)

· Management/orchestration/telemetry planes

· A description of how ISP‑specific attack surfaces will be modeled and exercised

· A description of how cloud service provider (CSP) infrastructure will be integrated and emulated within the range, including specific tools or platforms proposed (e.g., LocalStack, Azure Local)

· Quantitative capability claims (routes, sessions, throughput, timing precision) and supporting evidence.

· A plan for deployment, operation, reset, and sustainment in a Government lab environment, including the proposed operational model (Government‑operated, co‑managed, managed service)

· A cost estimate

· OPTIONAL: Company qualifications and experience that are notably related to requirements in this RFP can be included as an Appendix. This optional, brief Appendix may or may not be reviewed at the Assessment Team’s discretion and is not a requirement to submit.

Assessment Criteria

What is a Virtual Assessment Event?

ARCYBER submits specific problems to solve and CFIC utilizes its ecosystem and market research to attract best-of-breed submissions to solve the problem. ARCYBER subsequently reviews and selects participants with the highest value to present and/or demonstrate their capability in a private, virtual pitch / demo session hosted through an online platform with Government Stakeholders on a specific date.

Why Should You Participate?

ARCYBER seeks to enter into non-FAR or FAR-based agreements with Industry, Academic, and National Lab partners whose solutions are favorably evaluated by ARCYBER Subject Matter Experts. As such, these events are considered competitive in the same manner as a Broad Agency Announcement (BAA) or Commercial Solutions Opening (CSO), and solutions will be evaluated independently of one another primarily for technical merit.

Timeline Phase I: 21 JUL 2026 – Collaboration Event (completed) Industry, academia, and government partners met in person to identify current limitations and ideate ways to overcome limiting factors for an ISP cyber range. Problem statements were developed to frame ISP cyber range needs and prototype‑to‑production transition considerations.

Phase II: 10 SEP 2026 - 13 OCT 2026 – Submission Window / Q&A Session Industry, academia, and government partners MUST submit a submission response whitepaper document through Vulcan via this link – CLICK HERE. Submit NLT (No Later Than) 11:59p.m. Eastern on Tuesday, 13 OCT 2026.

Q&A Response Session: Fill out this form to submit questions related to this release which can be addressed by the Principal Stakeholder. The form will be open until 11:59p.m. (one minute prior to midnight) Eastern on 24 SEP. Thereafter, a virtual Response Session will be hosted on 05 OCT.

Phase III: 14 OCT 2026 - 27 OCT 2026 – Submissions Reviewed & Downselects Submitted documents will be placed in review based on rubric parameters identified through the requirements and criteria included in this document. Submissions will be reviewed by the Assessment Team and subsequently graded for potential down selection. The Assessment Team will conduct a final meeting to review graded whitepaper documents for down-selects of those respondents/submissions they feel have the highest potential to satisfy their needs. Favorably evaluated submissions will receive an invitation to virtually present.

Phase IV: 01 DEC 2026 - 03 DEC 2026 – Virtual Demonstration Presentations Demonstration presentations will be held virtually through MS Teams. During the time allotted, each presenting entity will demo their solution and capabilities that should satisfy, to the best of their ability, the requirements and criteria noted in this release. Each group will be notified of their presentation time and receive an MS Teams calendar invite. Thereafter, it is anticipated that selection for award may be on or about 10 DEC 2026.

Phase V: Follow-On The Government has several acquisition/contract vehicles (i.e., various IDIQ contracts, purchase orders, etc.) to potentially purchase the final solution if operationally viable. The Government may elect to purchase all, some, and/or none of the solutions from Phase IV for further projects. Once awarded, contracting with the selectee company is slated to begin on or about 06 JAN 2027.

How You Can Participate

· Submissions will be accepted ONLY through the Vulcan platform – CLICK HERE TO SUBMIT.

· Whitepapers MUST follow the format and template available on the Vulcan site noted above.

· A Vulcan submission instruction sheet is available for your convenience – DOWNLOAD THE PDF.

TEAMING FOR A WHITEPAPER SUBMISSION

Interested in teaming opportunities with other companies? Fill out this form NLT 11:59p.m. Eastern on 24 SEP 2026 to submit your capabilities and information will be collated and provided to you that was submitted by other companies interested, as well. All information provided will be sent out on or about 25 SEP 2026.

To learn more about how to use Vulcan, please refer to this information on the CFIC website - https://www.cyberfic.org/joinvulcan.

Questions?

For submission-related questions, please contact CFIC’s Associate Project Manager, Amanda Green, at agreen@cyberfic.org.

DISCLAIMERS:

An award under 10 U. S. Code, Section 2371b may result in award of a follow-on production in accordance with 10.U.S.C. 2371(f). Upon determination that the competitively awarded prototype project(s) has been successfully completed, and subject to the availability of funds, the prototype project(s) may result in the award of a follow-on production contract or transaction without the use of competitive procedures. Such awards may include multiple phases.

Non‐Government advisors may be used in the evaluation of submissions and will have signed Non‐Disclosure Agreements (NDAs) with the Government. The Government understands the information provided in this announcement is presented in confidence and may contain trade secret or commercial or financial information and agrees to protect such information from unauthorized disclosure to the maximum extent permitted and as required by law. An organization's participation in any part of the selection process under this announcement indicates concurrence with the aforementioned use of contractor support personnel.