Attachment 0001 - Request for Information.pdf

REQUEST FOR INFORMATION

Air Force Life Cycle Management Center (AFLCMC/HNCX) Platform One (P1)

1.0 Description

1.1 The Platform One Iron Bank Value Stream in support of the Air Force Life Cycle Management Center is seeking information from industry regarding potential approaches regarding the enhancement of cybersecurity within its container infrastructure and would like comments or questions from interested vendors. Specifically, the Iron Bank Value Stream on P1 is committed to enhancing cybersecurity within its container infrastructure by leveraging minimal/distroless images to significantly reduce its attack surface on the estimated 1,395 currently available containers.

1.2 THIS IS A REQUEST FOR INFORMATION (RFI) ONLY. This RFI is issued solely for information and planning purposes – it does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. This request for information does not commit the Government to contract for any supply or service whatsoever. Further, the Air Force is not at this time seeking proposals and will not accept unsolicited proposals. Respondees are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the interested party’s expense. Not responding to this RFI does not preclude participation in any future RFP, if any is issued. If a solicitation is released, it will be synopsized on the SAM.gov website and the Platform One Solutions Marketplace (P1SM) https://p1.dso.mil/marketplace. It is the responsibility of the potential offerors to monitor this site for additional information pertaining to this requirement.

2.0 Background

The Iron Bank Value Stream on P1, in its mission to enhance cybersecurity within its container infrastructure, is leveraging minimal/distroless images to significantly reduce its attack surface.

Utilizing distroless images eliminates unnecessary packages and dependencies, thereby minimizing potential vulnerabilities and simplifying security audits. This approach ensures that only essential components are included, enhancing the overall security posture.

2.1 Planned Production/Services Description: The contractor shall provide comprehensive support for the Iron Bank platform, encompassing ongoing operations, capability sustainment, and forward-leaning innovation. Services shall be delivered through the primary focus areas below:

2.1.1 Iron Bank Operations: Ongoing technical sustainment of Iron Bank images, including synchronization with upstream releases, vulnerability remediation, and documentation maintenance. Contractors will operate within an agile, collaborative environment, following government-established processes and standards to ensure stability, security, and functional interoperability.

https://sam.gov/content/home https://p1.dso.mil/marketplace

2.1.2 Together, these services ensure the Iron Bank platform remains mission-relevant, scalable, secure, and user-centered—positioning it as a key enabler of rapid software delivery across the Department of Defense.

2.2 Delivery Period/Period of Performance: One base year with two option year periods

2.3 Security Requirements: Ability to secure/maintain a TS/SCI and complete DD Form 254 Department of Defense Contract Security Classification Specification.

3.0 Requested Information

3.1 How would you attempt to rewrite and create new container repositories for approximately 50 Iron Bank Core images at an enterprise licensing level, including Big Bang and Party Bus Value Stream images encompassing Department of Defense (DoD) users, contractors/government/military/etc., personnel or those with official mission requirements per System Program Office (SPO), etc.?

3.2 How would you attempt to maintain a 60-day validation period for Big Bang instance deployment proof of concept with minimal images and ensure compliance with standards (e.g., FIPS 140-3)? In addition, how would you address line items for Iron Bank Core images not used by the Big Bang Value Stream, while adhering to Common Vulnerabilities and Exposures (CVE) response timelines below?

3.2.1 Critical: 5 days from discovery

3.2.2 High: 10 days from discovery

3.2.3 Medium: 30 days from discovery

3.2.4 Low: 60 days from discovery

3.3 How would you administer Iron Bank images necessary to support Big Bang Value Stream operations, ensuring continuous CVE vulnerability scanning response and updates as necessary to maintain high standards for security and compliance across all managed container images?

4.0 Responses

4.1 Interested parties are requested to respond to this RFI with a white paper.

4.2 White papers in Microsoft Word for Office 365 compatible format are due no later than 5 September 2025, 1:00pm EST. Responses shall be limited to Four (4) pages for Section 2 and submitted via e-mail only to Lisa Hartman, lisa.hartman@us.af.mil. Proprietary information, if any, should be minimized and MUST BE CLEARLY MARKED. To aid the Government, please segregate proprietary information. Please be advised that all submissions become Government property and will not be returned.

4.3. Section 1 of the white paper shall provide administrative information, and shall include the following as a minimum:

4.3.1. Name, mailing address, overnight delivery address (if different from mailing address), phone number, and e-mail of designated point of contact.

mailto:lisa.hartman@us.af.mil

4.3.2. Recommended contracting strategy.

4.3.3. Business type (large business, small business, small disadvantaged business, 8(a)-certified small disadvantaged business, HUBZone small business, woman-owned small business, service-disabled veteran-owned small business) based upon North American Industry Classification System (NAICS) code 541511. “Small business concern” means a concern, including its affiliates, that is independently owned and operated, not dominant in the field of operation in which it is proposing on Government contracts, and qualified as a small business under the criteria and size standards in 13 CFR part 121. A small business concern for the purposes of this procurement is generally defined as a business, including its affiliates, averaging no more than 34 million dollars in annual receipts. Annual receipts of a concern that has been in business for 3 or more complete fiscal years means the annual average gross revenue of the concern taken for the last 3 fiscal years. Annual receipts of a concern that has been in business for less than 3 complete fiscal years means its total receipts for the period it has been in business, divided by the number of weeks including fractions of a week that it has been in business, and multiplied by 52. Respondees are cautioned, however, that this is a general description only. Additional standards and conditions apply.

Please refer to Federal Acquisition Regulation (FAR) Part 19 for additional detailed information on Small Business Size Standards. The FAR is available at Acquisition.gov.

4.3.4 The facility security clearance of the responding vendor.

4.4 The number of pages in Section 1 of the white paper shall not be included in the four-page limitation, i.e., the four-page limitation applies only to Section 2 of the white paper.

4.5 Section 2 of the white paper shall answer the issues addressed in Section 3 of this RFI and shall be limited to Four (4) pages.

4.6 The Government may use contracted non-government advisors (NGAs) as subject matter experts to support Platform One personnel in the review of responses to this RFI, including review of any marked or unmarked proprietary information provided. Nondisclosure Agreements (NDAs) will be executed between the NGA personnel and Platform One. NGA personnel supporting this effort may include personnel from the following companies: [INSERT CONTRACTOR COMPANIES SUPPORTING YOU HERE]. Any response submitted constitutes consent for that response to be reviewed by military personnel, USG civilians, and NGAs. Any disclosure objection must be submitted to and resolved with the Contracting Officer listed below prior to submission of a corresponding RFI response.

5.0 Industry Discussions

P1 Iron Bank Value Stream representatives may or may not choose to meet with responding vendors. Such discussions would only be intended to get further clarification of potential capability to meet the requirements, especially any development and certification risks.

6.0 Questions

https://www.acquisition.gov/

For questions concerning this announcement, please utilize the Government Point of Entry (GPE) website at www.SAM.gov or the Q&A feature within the Platform One Marketplace Industry Portal or contact:

Contracting Officer, Lisa Hartman, lisa.hartman@us.af.mil.

Technical Point of Contact, Thomas Murphy, thomas.murphy.34@us.af.mil

Questions shall NOT contain proprietary or classified information. The Government does not guarantee that questions received after 5 September 2025, 1:00pm EST will be answered.

7.0 Summary

THIS IS A REQUEST FOR INFORMATION (RFI) ONLY to identify sources that can provide Iron Bank Value Stream potential solutions. The information provided in this RFI is subject to change and is not binding on the Government. The Air Force has not made a commitment to procure any of the items/services discussed, and release of this RFI should not be construed as such a commitment or as authorization to incur cost for which reimbursement would be required or sought. All submissions become Government property and will not be returned.

http://www.sam.gov/ mailto:lisa.hartman@us.af.mil mailto:thomas.murphy.34@us.af.mil