Atch 1. ARES_Statement of Objectives.pdf

Attachment 1: ARES Statement of Objectives (SOO)

Initial Revision, 11 Dec 25

Department of Air Force

PEO C3BM

Kessel Run Flight Operations

Aerospace Readiness Enterprise System (ARES) Statement of Objectives (SOO)

Revision Number Date

Initial Revision 11 December 2025

Table of Contents Section 1. INTRODUCTION Section 2. BACKGROUND Section 3. ORGANIZATION Section 4. OBJECTIVES Section 5. SCOPE

5.1 KEY SYSTEM CONSIDERATIONS

5.2 CURRENT STATE CHALLENGES

5.2.1 FRAGMENTED AND REDUNDANT SYSTEMS

5.2.2 MANUAL AND LABOR-INTENSIVE PROCESSES

5.2.3 LIMITED DATA INTEROPERABILITY

5.2.4 OUTDATED TECHNICAL ARCHITECTURES

5.2.5 INCONSISTENT USER EXPERIENCE

5.2.6 LIMITED REAL-TIME VISIBILITY AND ANALYTICS

5.2.7 SECURITY AND COMPLIANCE GAPS

5.2.8 SCALABILITY AND EXTENSIBILITY CONSTRAINTS

5.2.9 LACK OF DENIED, DEGRADED, INTERMITTENT, OR LIMITED (DDIL) OPERATIONAL

SUPPORT

5.2.10 ABSENCE OF AN ENTERPRISE PLATFORM FOUNDATION

5.3 FUTURE STATE OUTCOMES

5.3.1 OBJECTIVE 1: TECHNICAL ARCHITECTURE

5.3.2 OBJECTIVE 2: ACCESSIBILITY

5.3.3 OBJECTIVE 3: SCHEDULING

5.3.4 OBJECTIVE 4: SYLLABUS AND TRAINING MANAGEMENT

5.3.5 OBJECTIVE 5: STANDARDIZATION & EVALUATION (STAN/EVAL)

5.3.6 OBJECTIVE 6: WAIVER AND GO/NO-GO MANAGEMENT

5.3.7 OBJECTIVE 7: PERSONNEL, ACCESSIONS, AND PIPELINE MANAGEMENT

5.3.8 OBJECTIVE 8: REPORTING, ANALYTICS, AND INTELLIGENCE

5.4 PROTOTYPE SUCCESS DEFINITION

5.5 FOLLOW-ON PRODUCTION:

Section 6. Security requirements

6.1 Definitions

6.2 Security Requirements

6.3 Cyber Incident Reporting

6.4 Malicious Software

6.5 Media Preservation and Protection

6.6 Access to Information

6.7 Damage Assessment

6.8 Subcontracts

Section 7. SUMMARY

SECTION 1. INTRODUCTION

The purpose of this Statement of Objectives (SOO) is to award prototype projects under the authority of 10 U.S.C. § 4022 (“Authority of the Department of Defense to carry out certain prototype projects”) for the design, integration, configuration, and demonstration of the new Kessel Run Flight Operations (Flight Ops) Aerospace Readiness Enterprise System (ARES) capability within the Salesforce Operational Enterprise Architecture (OpsEA) environment. ARES will leverage OpsEA’s platform-native capabilities (workflow automation, analytics, AI, and API extensibility) to unify aircrew scheduling, training and readiness management across the Department of Air Force (DAF) aircrews, with scalability to non-aircrew personnel.

This prototype effort is conducted under the authority of 10 U.S.C. § 4022 (OTA for Prototype Projects).

Upon successful completion, the Government may exercise a follow-on production option under the same statutory authority consistent with the approved acquisition strategy.

The prototype will validate the operational suitability, scalability, and cybersecurity of OpsEA/Salesforce, in accordance with the requirements outlined in Section 6, as an enterprise solution environment for readiness management and will provide actionable recommendations for future production deployment. This prototype will be awarded as a fixed price Other Transaction Agreement (OTA) with an anticipated 3-month performance period and maximum 30 days for follow-on testing and transition.

The performance period, including the potential option, will begin once the contractor has been granted access to the OpsEA/Salesforce development environment/sandbox. Offerors are required to complete all mandatory OpsEA/Salesforce sandbox training prior to being considered for award of a Prototype OT Agreement.

This effort will employ a Challenge-Based Acquisition (ChBA) approach emphasizing an iterative prototype demonstration, user feedback, and challenge-based “bake-off” rather than just static paper submissions. Furthermore, this effort aligns with DoDI 5000.87 Software Acquisition Pathway, enabling an iterative delivery, continuous integration, and rapid fielding of software capabilities.

SECTION 2. BACKGROUND

The current aircrew scheduling, standardization/evaluation (stan/eval), and logging tools within the Department of the Air Force DAF BATTLE NETWORK are antiquated and lack a unified, “one stop shop” capability for aircrew scheduling and logging. Current and legacy tools remain fragmented, slow to update, and fail under limited bandwidth. Legacy crew scheduling processes are heavily manual, time-consuming, and vary widely across major commands (MAJCOMs), leading to delays and inconsistency across the flying community and limits commanders' ability to make timely peacetime and war time decisions. Manual and outdated processes cannot be scaled, nor do they operate at the speed of relevancy, inhibiting our advantages on the battlefield. Without automation and a new enterprise solution, aircrews face significant disadvantages when supporting peacetime and war-time operations, complex kill chain models, crew currencies, and operational readiness.

ARES was conceived to combine scheduling, training, and stan/eval applications, all supporting Mobility Air Forces (MAF), Combat Air Forces (CAF), and Air Education and Training Command (AETC) sortie scheduling. This enterprise solution optimizes the unit’s human/materiel resources in the schedule to maximize the value of each sortie, confirm total force readiness and exploit Wing lethality.

ARES will increase tactical readiness, reduce the number of training sorties required to maintain currencies and reduce time required for operator upgrades by optimizing aircrew scheduling assignments and integrating complementary systems data which enables accelerated DAF operational and strategic decision making.

ARES will be hosted within a cloud-based environment leveraging Platform as a Service (PaaS) that delivers a resilient mission planning application worldwide. The proposed solution must ensure required / continuous functionality in Denied, Degraded, Intermittent, or Limited (DDIL) operational environments. More specifically, ARES will integrate capabilities offered by the Puckboard, Patriot Excalibur (PEX), and Graduate Training Management System (G/TIMS) products, enabling transition from legacy systems to a modernized system of systems. ARES consolidation of multiple flight operations management programs (i.e., Puckboard, PEX, and G/TIMS) will drive efficiencies in managing development, integration and sustainment, as well as providing mission-ready forces to meet Air Tasking Order (ATO) taskings for global wartime and peacetime operations. The ARES product will comply with Department of Defense (DoD) directives, including the cybersecurity mandates detailed on Section 6, Secretary of the Air Force (SecAF) Operational Imperative for Readiness, and the Office of the Secretary of War (OSW) focus areas for Defense and Resiliency, National Defense Strategy priorities for Building a Resilient Joint Force & Defense ecosystem.

SECTION 3. ORGANIZATION

The Department of Air Force Program Executive Officer Command, Control, Communications and Battle Management’s (DAF PEO C3BM) mission is to deliver an integrated DAF BATTLE NETWORK, a systems-of-systems that provides resilient decision advantage. The PEO is the integrating entity for Command, Control, Communications and Battle Management within the department, acquiring capabilities to streamline the delivery of decision advantage capabilities.

Kessel Run is a Division within PEO C3BM and is responsible for delivering resilient command and control (C2) and targeting software capabilities that provide warfighters decision advantage on the battlefield. Kessel Run’s mission is to architect and acquire the means to connect weapon systems with warfighters and decision makers. The WingC2 Branch Program Management Office is a branch under Kessel Run that serves to inform and execute the ATO through agile combat employment and this is the organization where this requirement will be executed.

Air Force organizations (e.g., ACC, AETC, AMC) are each creating their own stove piped crew readiness tools built on disparate architectures, creating redundancy, limited data visibility, and creating challenges for readiness forecasting. The primary objective of ARES is to develop a cloud-based, mobile-accessible enterprise solution that will replace existing Air Force systems including G/TIMS, PEX, and Puckboard for managing aircrew readiness in the existing OpsEA environment.

The OpsEA environment includes Salesforce to consolidate mission applications into secure, modern, and interoperable platform ecosystem and Envision which is a data-integration and visualization platform that has been adopted by the Air Force. OpsEA is the DAF-owned enclave hosted on the Salesforce Government Cloud Plus (IL-4, FedRAMP High) platform, unifying readiness management through configurable modules and API-driven data integration. ARES will serve as the System of Record within this environment. OpsEA utilizes Flosum for CI/CD and uses Okta and SailPoint for enterprise Identity, Credential, and Access Management (ICAM).

SECTION 4. OBJECTIVES

The ARES program is designed to deliver a transformative capability that directly addresses the challenges of the current state. The system will achieve the following strategic objectives to produce a more agile, lethal, and ready force:

• Modernize Readiness Management: Consolidate multiple legacy capabilities into a single, cloud-based, future-proof enterprise system that can operate in a DDIL environment. This will streamline development, enhance cybersecurity, and reduce sustainment costs.

• Optimize Resource Allocation: Leverage Artificial Intelligence (AI), Machine Learning (ML), and real-time data to automate and optimize aircrew scheduling. This will maximize the value of each sortie, reduce training sorties required to maintain currency, and accelerate operator upgrade timelines.

• Enhance Decision-Making: Provide commanders and schedulers with predictive analytics, modeling and simulation capabilities, and a shared situational awareness picture. This will improve forecasting accuracy and enable data-driven decisions at all echelons.

• Improve User Experience: Deliver an intuitive, mobile-accessible interface that streamlines workflows and reduces administrative burden. This will decrease pilot workload strain and allow aircrews to focus on core mission tasks.

• Integrate into the DAF BATTLE NETWORK: Ensure ARES is a fully integrated node within the broader DAF C3BM digital ecosystem. This seamless interoperability is mandatory for enabling joint and combined operations.

SECTION 5. SCOPE

This SOO describes the development, configuration, integration, test, and requisite engineering support towards an initial instantiation of a prototype for ARES capability within the OpsEA Salesforce platform environment, leveraging platform-native capabilities (workflow automation, analytics, AI, and API extensibility) to unify aircrew scheduling, training and readiness management across the U.S. Air Force.

5.1 KEY SYSTEM CONSIDERATIONS

The Government’s operational and technical environment imposes several foundational considerations that must be addressed to ensure the solution can effectively support enterprise-level scheduling, readiness, and mission execution. These considerations establish the context within which the prototype will operate, spanning mission purpose, platform architecture, user scale, and security posture, and serve as baseline constraints for design, integration, and deployment. The following elements define the system environment that any viable prototype must accommodate.

Mission: Optimize unit human/materiel resources in operations schedules to maximize sortie value, confirm total force readiness, and exploit Wing lethality.

Platform: Operations Enterprise Architecture (OpsEA) using Salesforce as the underlying PaaS.

Users: Approximately 149,000+ users across MAF (~42k from Puckboard), CAF (~77k from PEX), Air Education and Training Command (AETC) (~30k from G/TIMS), Air Force Global Strike Command (AFGSC), United States Space Force (USSF), Air National Guard Base (ANGB), Air Force Reserve

Command (AFRC), and Air Force Special Operations Command (AFSOC).

Classification: Initial deployment at Impact Level 4 (IL-4) with rapid pathway to IL-6.

5.2 CURRENT STATE CHALLENGES

The Air Force’s current readiness management environment is fragmented across multiple legacy systems, each designed for specific mission needs, resulting in operational inefficiencies and limited enterprise visibility. The following challenges highlight the need for an integrated, modernized solution.

5.2.1 FRAGMENTED AND REDUNDANT SYSTEMS

Aircrew readiness, training, and scheduling are managed through separate legacy tools such as PEX, Puckboard, and G/TIMS. These systems do not communicate effectively, leading to redundant data entry, inconsistent information, and difficulty aggregating readiness data across commands.

5.2.2 MANUAL AND LABOR-INTENSIVE PROCESSES

Most scheduling and training workflows are executed manually, requiring significant administrative effort. Personnel must reconcile information across systems and spreadsheets, slowing decision-making and increasing error rates.

5.2.3 LIMITED DATA INTEROPERABILITY

Each legacy system uses a unique data schema and interface. There is no unified data layer or Application Program Interface (API) framework to enable seamless exchange of readiness data across the enterprise, hindering force-level reporting and analysis.

5.2.4 OUTDATED TECHNICAL ARCHITECTURES

Current systems are built on aging technologies that are difficult to maintain, lack scalability, and are not aligned with modern cloud or DevSecOps environments. Sustainment and modernization require high cost and specialized legacy expertise.

5.2.5 INCONSISTENT USER EXPERIENCE

Distinct interfaces and workflows across systems create inconsistent user experiences, steep learning curves, and data quality issues. Users often require system-specific training and rely on local workarounds.

5.2.6 LIMITED REAL-TIME VISIBILITY AND ANALYTICS

Readiness data is not updated or accessible in real time. Commanders lack predictive or AI-assisted analytics for forecasting crew qualifications or identifying readiness risks ahead of time.

5.2.7 SECURITY AND COMPLIANCE GAPS

Legacy environments vary in cybersecurity posture and do not consistently align with current DoD IL or Zero Trust standards. This complicates Authority-to-Operate (ATO) processes and elevates cyber risk.

This project will address these gaps by implementing the security controls defined in Section 6.2, which provides the framework for achieving ATO and mitigating cyber risk through NIST SP 800-171 compliance.

5.2.8 SCALABILITY AND EXTENSIBILITY CONSTRAINTS

Existing systems were developed for isolated mission sets and are not easily adaptable for enterprise-wide use or integration with new mission domains. Enhancements typically require custom development rather than modular configuration.

5.2.9 LACK OF DENIED, DEGRADED, INTERMITTENT, OR LIMITED (DDIL)

OPERATIONAL SUPPORT

Current readiness tools rely on continuous network connectivity and provide limited functionality in DDIL environments, creating operational risk in contested theaters.

5.2.10 ABSENCE OF AN ENTERPRISE PLATFORM FOUNDATION

There is no unified enterprise platform that governs readiness management or supports shared services.

This prevents standardization, automation, and centralized governance across the Air Force readiness enterprise.

NOTE: Information regarding legacy systems (PEX, Puckboard, G/TIMS) architecture and data migration is not relevant to this prototype, as we do not want offerors to be constrained or anchored by the current workflows and approaches. In addition, data migration is out of scope for the prototype phase. However, data migration from legacy systems will be a required activity during the production phase and will be addressed as part of the full deployment effort.

5.3 FUTURE STATE OUTCOMES

The ideal end state for ARES is a unified, enterprise-wide digital ecosystem that replaces legacy tools like PEX, Puckboard, and G/TIMS with a modern, secure, and user-friendly platform seamlessly integrating training management, scheduling, and stan/eval across all MAJCOMs. In this vision, ARES provides real-time visibility into readiness and resource utilization, enables data-informed decision-making, and functions reliably in contested or degraded environments. It supports mobile and cloud operations at higher security levels (IL-4 to IL-6), leverages commercial technology through agile DevSecOps processes, and serves as the single source of truth for all training and qualification data.

Ultimately, ARES enhances operational agility, efficiency, and lethality by giving commanders and airmen intuitive, resilient tools that optimize readiness and eliminate the fragmentation and inefficiencies of legacy systems.

The offerors(s) shall propose and implement innovative approaches to achieve the following objectives.

Objectives are expressed in terms of desired outcomes, not prescriptive methods of satisfying these objectives.

5.3.1 OBJECTIVE 1: TECHNICAL ARCHITECTURE

The solution shall be developed to meet the requirements defined in the Consolidated Requirements Document (CRD) and hosted on the OpsEA Salesforce platform and engineered to meet DoD IL-4 security requirements with compatibility for IL-6 cloud services. The strategy for IL-6 compatibility shall include a migration roadmap focusing on the offeror's workstreams to reduce rework when migrating to the future IL-6 environment (IL-6 accreditation is planned 12-18 months after prototype award). A DevSecOps pipeline will automate vulnerability management and ensure compliance with the Cyber Incident Reporting (Section 6.3), Malicious Software (Section 6.4) and Media Preservation (Section 6.5) requirements. More specifically, this will include but not be limited to:

• Ensure the prototype is hosted and developed on the OpsEA Salesforce platform.

• Build the prototype to meet IL-4 security requirements, with compatibility for IL-6 cloud services. To ensure a clear path to higher classification levels, the prototype shall not use any cloud services that are not forecast to be available at the IL-6 level unless approved by the Government in advance.

• Incorporate auditability, reporting, and platform ATO compliance as part of a CI/CD, DevSecOps hardened pipeline.

• Conform with the Salesforce Cyber Security platform requirements.

• Leverage commercial software, including 3rd-party OpsEA Salesforce marketplace apps, to the greatest extent possible to accelerate development and reduce long-term sustainment costs.

• The platform must be designed as a secure, modular, and scalable software solution built for extensibility to support the entire DAF enterprise and potential Joint/Allied partners.

5.3.2 OBJECTIVE 2: ACCESSIBILITY

The solution shall incorporate the implementation of RBAC and ICAM as primary methods for meeting the access control families required by NIST SP 800-171, as mandated in Section 6.2.a.1. Authorized users shall be able to assign or remove roles and permissions, mobile access (including Electronic Flight Bags (EFBs)) shall be supported, and users shall receive sanitized notifications and alerts for changes to scheduling, documentation, or personal information.

• Design the prototype to support access control with defined user roles and associated permissions.

• Enable systems/data access to be determined by user roles.

• Provide authorized users with the ability to assign or remove roles and permissions.

• Ensure accessibility via mobile devices, such as Electronic Flight Bags (EFBs).

• Provide notifications and alerts to users regarding changes to scheduling, documentation, or personal information.

5.3.3 OBJECTIVE 3: SCHEDULING

The solution shall provide comprehensive scheduling and event management that assigns individuals to locations and resources, verifies availability, and scales to support up to 160 sorties per day per flying squadron to accelerate pilot training pipelines. Role-tailored calendar views (e.g., 1-week, 2-week, monthly, and Gantt view) for Schedulers, Squadron Aviation Resource Management (SARM), Pilots, Loadmasters, and others shall enable creating, copying, and editing events, with conflict highlighting and auto-resolve recommendations, attendance tracking and reporting, mapping integration, embedded messaging (e.g., Slack, Mattermost), and AI-enhanced optimization of event creation and assignments.

• Support event scheduling capabilities, including assigning individuals to locations/resources and verifying availability.

• Provide calendar views (e.g., 1-week, 2-week, monthly, and Gantt view) tailored to user roles (Schedulers, SARM, Pilots, Loadmasters, etc.).

• Enable creation, copying, and editing of event details in calendar view.

• Support scheduling up to 160 sorties per day per squadron to accelerate pilot training pipelines.

• Highlight and resolve scheduling conflicts, including "auto resolve" conflict recommendations.

• Track attendance and report student attendance.

• Incorporate instant messaging/group chat for scheduling events (e.g., Slack, Mattermost).

• Support AI-enhanced scheduling to optimize event creation and individual assignments.

5.3.4 OBJECTIVE 4: SYLLABUS AND TRAINING MANAGEMENT

The solution shall deliver end-to-end syllabus management and training progress tracking, enabling the creation and maintenance of formal training syllabi, assignment to individuals and classes, and management of versions and event dependencies. Users shall be able to view progress for individuals and classes, manage courses across delivery types (virtual, Computer-Based Training (CBT), in-person, simulators), maintain academic calendars, and forecast graduation dates based on start dates and syllabus length.

• Enable building and managing formal training syllabi.

• Support assigning training syllabi to individuals and classes, including tracking syllabus versions and dependencies among events.

• Provide tools to view training progress for individuals and classes.

• Allow management of training courses for various types (e.g., virtual, CBT, in-person, SIMs) and support interfacing with existing computer-based training (CBT) solutions.

• Enable creation and modification of academic calendars encompassing all required training.

• Forecast class graduation dates based on start dates and syllabus length.

5.3.5 OBJECTIVE 5: STANDARDIZATION & EVALUATION (STAN/EVAL)

The solution shall streamline stan/eval processes by providing tools to build, administer, and track routine qualifications, documenting individual qualification status, highlighting expirations, and assigning remedial training when needed. It shall also support squadron-level management of local qualifications, certifications, and syllabi such as Aircraft Commander Upgrade and Just-in-Time Training.

• Provide tools to build, administer, and track routine qualifications.

• Document qualification statuses for selected individuals, including expiration dates and highlighting expired qualifications/certifications.

• Assign remedial training when required.

• Support management of local qualifications, certifications, and syllabi at squadron levels (e.g., Aircraft Commander Upgrade, Just-in-Time Training certification).

5.3.6 OBJECTIVE 6: WAIVER AND GO/NO-GO MANAGEMENT

The solution shall enable end-to-end waiver management, including requesting, submitting, routing, and approving waivers for specific requirements. Routing chains shall be defined by waiver type with visible status and final approvals, users shall be able to review waivers by status and approval level, and waivers will be tracked by individual, event, dates, or combinations of data, with higher echelons empowered to sign off on AFI bypasses as appropriate.

• Enable requesting, submitting, and approving waivers for specific requirements.

• Define routing chains by waiver type and visibly display routing and final approval status (i.e.

signatures).

• Allow users to review all waivers by status and level of approval.

• Track waivers by individual, event, dates, or combinations of data.

• Ensure higher echelons of command can sign off on waivers to bypass Air Force Instruction requirements.

5.3.7 OBJECTIVE 7: PERSONNEL, ACCESSIONS, AND PIPELINE MANAGEMENT

The solution shall enhance training class and pipeline management by supporting batch addition of students with prerequisite verification, managing courses across types and locations with forecasted variables, and incorporating existing AETC syllabi to build structured series of classes. It shall track trainee and airframe progress through pipeline stages, assign onboarding tasks and responsibilities, generate reports and analytics on pipeline status and efficiency, and integrate with external systems such as ARTEMIS for asset assessment and onboarding.

• Support batch addition of multiple students to classes and verify prerequisites.

• Enable management of training courses for various types, locations, and forecasted variables.

• Incorporate existing AETC syllabi/courses and build structured series of classes.

• Track the progress of trainees and airframes through various stages of the pipeline.

• Assign tasks and responsibilities to team members involved in onboarding processes.

• Generate reports and analytics on the status and efficiency of the pipeline.

• Integrate with external systems (e.g., ARTEMIS) to gather necessary information for asset assessment and onboarding. Integration with ARTEMIS and Envision (the centralized Air Force data hub and instance of Palantir's Foundry) will be required for the prototype phase; ARES must be able to publish/subscribe its data to Envision.

5.3.8 OBJECTIVE 8: REPORTING, ANALYTICS, AND INTELLIGENCE

This capability area elevates ARES from a simple management tool to a strategic and intelligent command and control (C2) platform. It directly supports the strategic goal of Enhancing Decision- Making by equipping commanders with the predictive insights needed to optimize readiness and proactively manage the force. Capabilities include trend analysis, predictive modeling, and customizable data visualizations.

5.4 PROTOTYPE SUCCESS DEFINITION

To ensure the prototype demonstration yields decision-quality insights and provides a defensible basis for follow-on Production OT award, the Government establishes clear objectives that define what constitutes a successful prototype. These objectives guide prototype development efforts, anchor the demonstration to outcomes that matter to operational users, and ensure alignment with the Department of War’s operational priorities, mission needs, and risk tolerance. The objectives outlined herein serve as the Government’s definition of what constitutes meaningful prototype progress and value; they do not prescribe or describe the Government’s evaluation methodology.

A successful prototype shall demonstrate the ability to operate effectively on the OpsEA Salesforce platform with a clear and supportable path toward required security baselines, while meeting the Government’s threshold functional and non-functional requirements and achieving expected performance levels. The required security baselines are defined in Section 6.2 with NIST SP 800-171 being the minimum standard. It shall provide operationally suitable user experience and workflow that ACC, AMC, and AETC representatives find mission-supportive and viable for their operational contexts. The prototype shall also show the potential to scale to enterprise demand, integrate with required authoritative data sources to enable end-to-end mission workflows, and present a credible security posture is one that demonstrates verifiable compliance with these requirements. Finally, the approach shall demonstrate inherent extensibility, showing that the architecture and design can accommodate additional MAJCOMs, mission profiles, and use cases without major redesign.

5.5 FOLLOW-ON PRODUCTION:

Subject to determination of a successful prototype and the availability of funds, the Government intends to award a single follow-on OT for ARES production. The follow-on production OT will consist of additional requirements for development, fielding, testing, and scaling of the ARES solution for operational use. Once the Government selects the final single offeror and solution for award of a follow-on OT, the Government will issue a final Request for Proposal (RFP) to the selected offeror. The selected offeror will submit a new Production Proposal, and the Government will negotiate final award of the Production OT.

SECTION 6. SECURITY REQUIREMENTS

This section outlines the security requirements for all work performed under this agreement. All participants shall adhere to these requirements to protect sensitive information.

6.1 Definitions

For the purposes of this section, the following definitions apply:

• Adequate Security: Protective measures commensurate with the potential impact and likelihood of loss, misuse, unauthorized access, or modification of information.

• Compromise: The disclosure of information to unauthorized individuals or a violation of a system's security policy, potentially involving unauthorized intentional or unintentional disclosure, modification, destruction, loss, or copying of information to unauthorized media.

• Controlled Technical Information: Technical information with military or space applications subject to access, use, reproduction, modification, performance, display, release, disclosure, or dissemination controls. This information, if disseminated, would warrant distribution statements

B through F, per DoD guidelines. This term excludes information lawfully publicly available without restrictions.

• Covered Contractor Information System: Any unclassified information system owned or operated by or on behalf of a participant that processes, stores, or transmits covered defense information.

• Covered Defense Information: Unclassified controlled technical information, or other information identified in the Controlled Unclassified Information (CUI) Registry, that requires safeguarding or dissemination controls according to laws, regulations, and Government-wide policies. This includes information:

• Marked or identified in this agreement and provided by or on behalf of the Government.

• Collected, developed, received, transmitted, used, or stored by or on behalf of the participant in support of this agreement.

• Cyber Incident: Actions taken through computer networks resulting in a compromise or an adverse effect on an information system and/or the information therein.

• Forensic Analysis: The gathering, retaining, and analyzing of computer-related data for investigative purposes while maintaining data integrity.

• Information System: A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

• Malicious Software: Software or firmware intended to perform unauthorized processes that adversely impact the confidentiality, integrity, or availability of an information system, including viruses, worms, Trojan horses, spyware, and certain forms of adware.

• Media: Physical devices or writing surfaces (e.g., magnetic tapes, optical disks, printouts) where covered defense information is recorded, stored, or printed within a covered contractor information system.

• Operationally Critical Support: Supplies or services designated as critical for airlift, sealift, intermodal transportation, or logistical support essential to Armed Forces mobilization, deployment, or sustainment in a contingency operation.

• Rapidly Report: Within 72 hours of discovering a cyber incident.

• Technical Information: Technical data or computer software. Examples include research and engineering data, drawings, specifications, standards, process sheets, manuals, reports, orders, catalog-item identifications, data sets, studies, analyses, and related information, and computer software executable code and source code.

• Participant Attributional/Proprietary Information: Information that identifies the participant(s), whether directly or indirectly, by the grouping of information that can be traced back to the participant(s) (e.g., program description, facility locations), personally identifiable information, as well as trade secrets, commercial or financial information, or other commercially sensitive information that is not customarily shared outside of the company.

6.2 Security Requirements

All participants shall provide adequate security on all covered contractor information systems used in performance of this agreement. At a minimum, participants shall implement the following protections:

1. For covered contractor information systems not operated on behalf of the Government:

a. Implement the security requirements specified in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, "Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations," in effect at the time of this agreement.

b. Participants may request a variance from specific NIST SP 800-171 requirements if a requirement is deemed not applicable or if an alternative, equally effective security measure is proposed. Such requests must be submitted in writing to the GCA for consideration and approval. Approved variances shall be documented as part of this agreement.

2. Apply additional information systems security measures if reasonably determined that additional measures are required to provide adequate security in a dynamic environment or to accommodate special circumstances (e.g., medical devices) and any individual, isolated, or temporary deficiencies based on an assessed risk or vulnerability.

6.3 Cyber Incident Reporting

1. Upon discovering a cyber incident affecting a covered contractor information system or covered defense information, or affecting the participant's ability to perform operationally critical support tasks, the participant shall:

a. Conduct a review to identify compromised information, systems, and accounts, including analyzing affected systems and other systems that may have been accessed as a result of the incident.

b. Rapidly report cyber incidents.

2. Cyber incident reports shall be treated as information created by or for DoD.

3. Participants reporting cyber incidents must have or acquire a DoD-approved medium assurance certificate.

6.4 Malicious Software

When malicious software is discovered and isolated in connection with a reported cyber incident, it shall be submitted.

6.5 Media Preservation and Protection

Following the discovery of a cyber incident, participants shall preserve and protect images of all known affected information systems and relevant monitoring data for at least 90 days from the submission of the cyber incident report.

6.6 Access to Information

Upon request, participants shall provide access by the government to additional information or equipment necessary for forensic analysis related to a cyber incident.

6.7 Damage Assessment

If a damage assessment is conducted, the participant will provide all relevant information gathered in accordance with Media Preservation and Protection.

6.8 Subcontracts

The substance of this Security Section must be flowed down to all sub-agreements where the work involves operationally critical support, or for which the subcontract performance will involve covered defense information, including subcontracts for commercial products or commercial services.

SECTION 7. SUMMARY

The U.S. Air Force seeks to modernize and unify its legacy aircrew readiness systems through the ARES prototype effort. ARES will serve as the next-generation enterprise capability that consolidates scheduling, training, and standardization and evaluation (stan/eval) functions across multiple MAJCOMs into a single, secure, and data-driven platform.

This prototype effort will evaluate the feasibility and operational suitability of implementing ARES capabilities on the OpsEA Salesforce platform. The project will focus on leveraging Salesforce’s native configuration, low-code development, and automation tools to streamline readiness management, reduce administrative burden, and enable real-time decision-making at the tactical and command levels.

The effort will be executed under an Other Transaction (OT) Prototype Agreement, allowing flexibility and collaboration between the Government and non-traditional industry partners. Using a Challenge- Based Acquisition (ChBA) approach, vendors will iteratively demonstrate, validate, and refine their prototype capabilities based on operational user feedback rather than static documentation.

Through this effort, the Air Force aims to:

• Modernize readiness management using a PaaS model that is secure, scalable, and interoperable with enterprise systems.

• Preserve legacy data across existing readiness tools (e.g., PEX, Puckboard, G/TIMS) and authoritative Air Force data systems (e.g., MilPDS, ADLS).

• Enhance user experience through intuitive, human-centered design that reduces training and scheduling friction for aircrew and commanders.

• Strengthen cybersecurity posture by implementing the requirements of Section 6, which establishes the foundation for IL-4 compliance and the future pathway to IL-6.

• Demonstrate the ability to extend platform capabilities using modular design, open APIs, and AI-driven analytics to forecast readiness trends.

The outcome of this prototype will be a validated proof of concept showing how OpsEA Salesforce platform can serve as a viable enterprise environment for Air Force readiness operations, while offering a repeatable and adaptable framework for future mission applications.

Upon successful demonstration, the Government intends to evaluate the prototype results for potential follow-on production under OT or alternative acquisition authorities. The Government contemplates awarding a single follow-on production Other Transaction Agreement (OTA). Only offerors who successfully deliver a prototype will be eligible for consideration for the production award.

The Government and prototype contractor(s) will jointly participate in two-week sprint reviews and monthly Integrated Product Team (IPT) meetings to evaluate prototype progress, review backlog items, and adjust objectives as required under agile acquisition best practices.

The results of this prototype will be used to inform the Air Force’s acquisition approach, cost realism analysis, and contract structure for any follow-on production effort.

Upon completion, the contractor shall deliver all artifacts, technical data, and source code sufficient to enable Government re-competition, transition to sustainment, or integration into Air Force enterprise services.

Section 7. SUMMARY