Attachment 1 - Call for Solutions - SUNet Modernization - DOWCDAO-ARL-26-01.pdf

This Call for Solutions solicitation is associated with the Army's Open Solicitation, W9128Z-25-S-A002.

Please see the referenced link for more information.

Link: https://sam.gov/opp/e486c3a09b594cba8c1e1b06d23aef4a/view

Note 1: Please advise the cognizant Contracts/Agreements Officer and Specialist as soon as possible via the email above if your organization intends to submit a Solution Brief in response to this Call for Solution.

Note 2: ARL and CDAO will host a Question and Answer (Q&A) session virtually on or about 12 February 2026 (tentatively). In order to attend this session, interested vendors must email their company name and Commercial and Government Entity (CAGE) code to usarmy.adelphi.devcom-arl.list.nextgenSUNet@army.mil before 2:00pm ET on 10 February 2026 for the purpose of the Government validating the vendor’s SECRET facility clearance. Once the clearance has been validated, a virtual attendance link will be sent to the interested vendor. Any questions pertaining to this Call for Solution must be submitted to the email address usarmy.adelphi.devcom-arl.list.nextgenSUNet@army.mil by 2:00pm ET on 10 February 2026. Vendors who fail to submit required clearance information by 2:00pm ET on 10 February 2026 are not guaranteed facility clearance validation, which is required to attend the virtual Q&A session. However, those vendors may receive a summary of the virtual Q&A session (including responses to questions discussed), after the Government has validated their SECRET facility clearance and prior to the Solution Brief submission deadline. Before receiving the Q&A summary, vendors must submit their company name and CAGE code to usarmy.adelphi.devcom-arl.list.nextgenSUNet@army.mil for clearance verification.

Project Number Call for Solution – DOWCDAO-ARL-26-01 Open Solicitation Number W9128Z-25-S-A002 Mission Partner Office of the Undersecretary of War for Research and Engineering (OUSW(R&E)) Chief Digital and AI Office (CDAO), in collaboration with the U.S. Army Research Laboratory (ARL)

Call for Solution Title Secure Unclassified Network (SUNet) Modernization

Issued By Army Contracting Command (ACC), Aberdeen Proving Ground (APG) Adelphi

Submission Instructions To respond to this Call for Solution, please refer to Sections 6 of this Call for Solution

SUNet modernization questions/clearance submission deadline

Tuesday, 10 February 2026 at 1400 ET (See Note 2 below)

SUNet modernization Q&A On or about Thursday, 12 February 2026 (See Note 2 below)

Solution Briefs Due Date/Time (Suspense) Wednesday, 25 February 2026 at 1200ET

Submit Solution Brief To Agreements Officer:

Ariel.m.amey.civ@army.mil Specialist: william.p.korzeniewski.civ@army.mil https://sam.gov/opp/e486c3a09b594cba8c1e1b06d23aef4a/view mailto:usarmy.adelphi.devcom-arl.list.nextgenSUNet@army.mil mailto:usarmy.adelphi.devcom-arl.list.nextgenSUNet@army.mil mailto:usarmy.adelphi.devcom-arl.list.nextgenSUNet@army.mil mailto:usarmy.adelphi.devcom-arl.list.nextgenSUNet@army.mil

Secure Unclassified Network (SUNet) Modernization

1.0 Problem Statement

The Department of War (DoW) requires the next generation of its Secure Unclassified Network (SUNet) system. SUNet is a government owned, secure, unclassified digital environment that enables DoW and mission partners to rapidly experiment with new software and develop Artificial Intelligence and Machine Learning (AI/ML) tools off the Department of Defense Information Network (DoDIN)-- without sacrificing cybersecurity. SUNet acts as a digital sandbox and provides logically segmented areas of compute and storage resources for DoW and mission partners to collaborate, label data, rapidly onboard, experiment with, develop, and validate emerging AI/ML tools. CDAO is seeking innovative and modernized approaches to the challenge areas listed below. The overall objective is to iteratively develop and demonstrate a next generation SUNet that is optimized for rapid experimentation, development, testing, and validation of AI/ML tools, as well as data labeling, off the DoDIN. See specific requirements in sections 3.0.

2.0 Background:

SUNet acts as a digital sandbox and provides logically segmented areas of compute and storage resources for DoW and mission partners to collaborate, label data, rapidly onboard, experiment with, develop, and validate emerging AI/ML tools. The legacy SUNet system was born out of the need for warfighters to securely collaborate and share information and data with foreign partners, without a Common Access Card (CAC), during the Global War on Terror. The legacy system was primarily architected in 2015. Based on state of technology at the time, SUNet infrastructure is currently centered around legacy hardware in a data center. As of 2025, SUNet Enclaves, logically segmented collection of compute and storage resources within an accreditation boundary, are in a hybrid environment in this data center alongside AWS and Azure cloud service providers (CSP).

The evolution of AI/ML technology over the last decade has fundamentally changed the operating environment and war fighting for the DoW. Consistent with this reality, SUNet’s mission and architecture evolved to fill a critical gap in the Department—the ability to collaborate and rapidly experiment in a secure digital sandbox Impact Level 5 (IL5) environment with non-traditional partners on AI/ML workloads, without a CAC, in a government-owned environment. SUNet is accredited by an Authorizing Official (AO) to host Controlled Unclassified Information (CUI) data. It is the only accredited off-DODIN platform of its kind.

3.0 Desired Solution Objectives

CDAO is seeking innovative and modernized approaches to the challenge areas listed above. The overall objective is to iteratively develop and demonstrate a next generation SUNet that is optimized for rapid experimentation, development, testing, and validation of AI/ML tools, as well as data labeling, off the DoDIN. Specific requirements include:

3.1 Deliver the ability to rapidly onboard a diverse range of customers including DoW, academia, industry, commercial, foreign partners, federally funded research and development centers, and other USG entities.

3.2 Demonstrate ability to establish at least seven (7) types of segmented virtual enclaves (logically segmented collection of compute and storage resources within an accreditation boundary) with specific characteristics to provision to customers for development and operational activities. Enclave types must include:

i. Enclave One that includes the following characteristics:

1. Hybrid on-premises and cloud infrastructure with on-prem infrastructure available for testing of specific processors’ ability to support AI tool testing with cloud backup for data and models.

2. Ability to host and/or connect to a comprehensive and searchable data catalog to facilitate intuitive data discovery and access for all users and implement functionality for users to upload and manage data sheets and “DataCards” ensuring data integrity and the association of proper metadata.

3. Diverse user group including government users and traditional DoW vendors with CACs as well as academia and non-traditional industry users without CACs requiring alternative Multi-factor authentication (MFA) implementations.

4. Software development and testing capabilities focused on AI/ML models with custom service-owned data sets.

5. Multiple simultaneous projects with different vendors, necessitating strict access controls to limit exposure of vendor proprietary information (e.g., code) to other vendors while operating in the same Enclave.

ii. Enclave Two that includes the following characteristics:

1. Provide a secured IL5 environment for data labeling of full motion video data to develop and develop AI/ML algorithms.

2. Ability to monitor and restrict download capability by individual user.

iii. Enclave Three that includes the following characteristics:

1. Ability to securely enable tenants with IL5 data to connect to the internet while restricting internet access to other tenants as required.

2. Ability to develop and test software in a pre-production environment.

3. Production environment for deployment of developed software and integration with multiple external partners (external to SUNet) for incoming and outgoing data products.

iv. Enclave Four that includes the following characteristics:

1. Ability to interact with edge systems that have intermittent connectivity to CSP platforms.

2. Support for non-standard hardware to enable mission-specific communication capabilities.

3. Ability to move AI models and data via cross domain solution.

v. Enclave Five that includes the following characteristics:

1. Ability to communicate to and from remote sites securely via virtual private network (VPN)

2. Support for non-standard communication protocols to transfer data to/from edge environments.

vi. Enclave Six that includes the following characteristics:

1. Managed attribution to support anonymous data collection across the Internet.

vii. Enclave Seven for Secure Development/Testing Environment that includes the following characteristics:

1. Securely support use of non-standard tools and software that are required for development of specialized products but may not be able to be fully hardened (e.g., have dependencies on vulnerable components) including use of CUI data.

2. Securely support the testing of software and products with CUI data prior to hardening to determine if they are worth the investment

3.3 Deploy mission-specific data and tools in different enclaves to fulfill mission-specific requirements. This includes:

o Tools to manage data sheets and “datacards” ensuring data integrity and the association of proper metadata;

o Tools to facilitate streamlined user onboarding;

o Tools to facilitate robust account management;

o Tools to conduct model and container integration (i.e. GitLab) to include built in scanning capabilities to ensure the integrity of all imported assets;

o Secure data ingest pipelines featuring a built-in sequestration capability to isolate and manage data according to specified security and access control pieces;

o Provide comprehensive support for data movement, including secure transfers to and from Amazon Web Services (AWS), on premise data stores, and external third-party data stores, as well as the logistical management of physical hard drive shipments for larger data sets.

o Enable sensor "reach back" and facilitate reliable data transfer utilizing Short Burst Data (SBD) and any other applicable communication protocols.

3.4 Deploy enterprise tools and data management capabilities that are accessible to different enclaves to fulfill common requirements. This includes:

o Downloading software libraries o Tools to manage data ingest, tracking, and cataloguing;

o Tools to support system updating, patching, and maintenance without requiring enclaves to directly access the Internet (e.g., vendor patch repositories, community DevSecOps pipelines, and related capabilities);

o Tools to track file ingress and egress, including Data Loss Prevention capabilities;

o Robust Security Information and Event Management (SIEM) solution for enterprise level log and event management, and Security Operations Center (SOC) capabilities;

o Cybersecurity tools and support services, including vulnerability and configuration scanning, report distribution, Plan of Action and Milestones (POA&M) management, Enterprise Mission Assurance Support Services (eMASS) record management, and related functions, in accordance with DoW and CDAO guidance, policies and procedures, and to enable mission partners to maintain compliance with cybersecurity requirements;

3.5 Demonstrate a hybrid system design with both on premise and multi-cloud infrastructure.

3.6 Demonstrate ability to configure GPU/CPU resources.

3.7 Meet Zero Trust Architecture and National Institute of Standards and Technology Special Publication (NIST SP) 800-53 Rev 5 requirements.

o The automated, robust auditing system for user access to data must monitor and validate that individual access to datasets aligns with the specific distribution statements and controls of said data.

3.8 Implement automation to minimize down time, reduce risk of mistakes (human error), and meet cybersecurity requirements of the platform’s Authority To Operate (ATO). For example, implement infrastructure as code (IAC), to include automating the creation, modification, and management of SUNet infrastructure resources and services in accordance with modern DevSecOps software lifecycle best practices, DoW guidance, and CDAO guidance.

3.9 Support remote access by users (including administrators) to their respective environments securely, minimizing risks for data leaks, introduction of malicious code, and similar issues in a Bring Your Own Device (BYOD) environment. Users should not be required to be at an onsite location in order to access SUNet for most functions (emergency functions excepted and limited to enterprise engineers/system admins).

3.10 Maximize automation of DevSecOps practices to improve the software baseline management and integrity across all environments (e.g. development, test, training, and production), and limit manual processes for deployment of resources. Real time scanning of containers in use and managing patching/updating should also be supported.

3.11 Demonstrate system ability to become authorized to host CUI data at IL5.

3.12 Demonstrate modular and scalable infrastructure that maximizes flexibility and avoids vendor-lock.

3.13 Maximize monitoring capabilities to improve security.

3.14 Maximize fully-managed cloud native services.

3.15 Implement Identity, Credential, and Access Management (ICAM), to include authentication, authorization, and auditing capabilities, to ensure secure access to DoW resources. The solution must integrate with existing DoW identity management systems and provide user activity monitoring and regular access reviews to enhance security (i.e. SUNet must enable users to be able to access SUNet with a CAC). SUNet must also support ICAM for non-CAC holders using alternate technologies with equivalent security protections for access.

o The solution should demonstrate an ability to conduct robust account management, user access permissions, and user activity tracking

3.16 Demonstrate ability to conduct data governance and management.

3.17 Demonstrate ability to implement a clear and simple charge back model for SUNet customers.

3.18 Implement configuration and knowledge management best practices to enable the SUNet operations and leadership teams to be able to cleanly separate the SUNet infrastructure from SUNet Enclaves for purposes of funding, operational, and cybersecurity decisions.

3.19 Demonstrated expertise in code management solutions (e.g. GitLab) for advanced version control, Continuous Integration and Continuous Delivery (CI/CD) pipeline management, and repository administration.

3.20 Demonstrated experience with multiple major cloud platforms, including deep knowledge of Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) solutions.

3.21 Demonstrated proficiency in operating systems and networking.

3.22 Thorough understanding and practical application of Security Technical Implementation Guides (STIGs and SRGs, as well as vendor hardening guides for less common technologies), CSP security checklists/benchmarks, and expertise in utilization of common tools for system hardening and security compliance, POA&M management, eMASS record management, cybersecurity reporting, and related functions.

3.23 Demonstrated experience in architecting solutions for managing and analyzing large-scale datasets, including expertise in modern big data technologies and frameworks.

3.24 Demonstrated experience in Information System Security Officer (ISSO) and Information System Security Manager (ISSM) roles, with expertise operating within government security and compliance frameworks.

4.0 Project Expectations

1. The SUNet prototype must include the enclave types/characteristics outlined in Section 3.2.

2. The prototype should be developed enough to test basic use cases no later than 20 weeks (5 months) from contract award/start.

3. The prototype should be refined and proven enough to be considered a minimum viable product no later than 6 months from contract award/start.

4. The government’s intent is to award a separate follow-on production contract(s) or transaction(s) (reference section 10.0 below) for a valid prototype. Companies should demonstrate the ability to develop the minimum viable product (end result of the prototype) into the full production system no later than 6 months from contract award/start.

5.0 Awarding Instrument

This Call for Solution solicitation will be awarded in accordance with the Army Open Solicitation (AOS) procedures detailed within Solicitation W9128Z-25-S-A002.

6.0 Submission Instructions

6.1 Submission Overview: Companies responding to this call shall submit a Solution Brief for evaluation. Submissions are to be sent via email only to the Agreements Officer and Specialist (POCs) listed in this Call for Solutions. We are interested in unique and innovative approaches, including techniques to reduce costs, improve efficiency, and enhance performance. The Government may utilize up to three (3) phases for assessing solutions:

1. Solution Brief – a white paper including a technical discussion explicitly addressing the target problem statement and how the proposed solution meets the Objectives and evaluation criteria. Solution Brief format and instructions are in Section 6.2 below.

2. Live Pitch (unless bypassed) – an oral briefing/demonstration with a technical challenge with instructions provided following phase 1.

3. Solution Proposal – a written technical approach, statement of work, and pricing proposal in response to a request for solution proposal.

Additionally, the Government will host a Q&A session virtually on or about 12 February 2026. For information on how to participate in this Q&A, interested vendors should reference “Note 2” on the cover page of this Call for Solutions. No additional questions are permitted after the Q&A.

6.2 Solution Brief Format and Instructions: Solution Briefs shall conform to the following, and in the following order. Each Solution Brief shall not exceed seven (7) written pages (not including the title page, company information, or table of contents) using a font that is readable without magnification. Use of diagram(s) or graphics with associated bullet points and text layout to depict the essence of the proposed solution is strongly encouraged. Should offerors submit anything longer, the Government will only evaluate the first seven (7) pages of a Solution Brief.

• Title Page: Company information shall include the following:

Name of Company Business Size Company’s Commercial and Government Entity (CAGE) number Unique Entity Identifier (UEI) number Contracting Point of Contact (POC) [Name, Phone, Email] Technical POC [Name, Phone, Email]

• No more than two (2) pages including three (3) gate criteria:

Gate criteria 1: verifiable documentation that the vendor holds a SECRET facility clearance and is TS SCI eligible; and Gate criteria 2: a projected milestone plan showing the proposed prototype solution can be refined and proven enough to be considered a minimum viable product no later than 6 months from contract award/start and the prototype is able to be refined into a full production system within 6 months following prototype completion; and

Gate Criteria 3: Between one (1) and three (3) references demonstrating experience with similar projects or programs with at least one (1) referencing experiences with the federal government.

• Four (4) pages of technical discussion explicitly addressing the target problem statement and how the proposed solution meets the evaluation criteria.

These four (4) pages shall include a plan to demonstrate a proposed SUNet prototype that meets the Project Expectations referenced in 4.0 and the objectives in 3.0. The proposed solution must demonstrate the ability to fulfill all desired objectives and enclave characteristics in their entirety. Each submission should include details on existing certifications for technical components of their plan.

• One (1) page Rough Order of Magnitude (ROM) which includes the estimated out-the-door total price to implement the proposed solution for 20,000 annual users for three (3) years.

Rough Order of Magnitude:

Proposer solution brief must provide a ROM estimate clearly communicating the pricing for each desired solution feature in section 3 above. Sample format:

Desired Solution Features (reference section 3.0)

Estimate

Section # or #s (3.X…) $

[Add more rows as needed] $

TOTAL $

7.0 Evaluation Process and Criteria

The Government will conduct evaluations and make award selections in accordance with the technical, merit-based CSO authority. Solution Briefs submitted against this Call for Solutions will be vetted against gate criteria prior to evaluation. Submissions must minimally meet the gate criteria outlined in section 6.2.

The Government will do an initial evaluation of the solution brief and if it is determined that the submissions do not meet the gate criteria, it will be deemed “not selectable” and will not be further evaluated. Submissions meeting the gate criteria will be assessed in accordance with the evaluation criteria cited below and scoring rubric in Table 1 and rated as either “selectable” or “not selectable” for Phase I. Contractor support may be utilized to support proposal evaluation in a non-decision making capacity. If the Government determines contractor support will be utilized, any contractor personnel involved in the evaluation will be required to sign non-disclosure agreements. By submitting a Solution Brief, you authorize the white paper to be distributed and used for this purpose. During the assessment period, the Government and/or supporting Subject Matter Experts (SMEs)/advisors may contact submitting entities to clarify submitted information.

The Government will inform Companies whether they have or have not been selected to move forward to the next phase. Those Companies whose Solution Briefs are deemed "selectable" will be invited to submit a more comprehensive Pitch and/or Proposal. At that time a due date and time for the following phase will be communicated.

After pitches, the Government may further down-select potential awardees and issue a request for solution proposal (“RSP”) to the remaining candidate company (or companies). The RSP will have specific guidelines for submission and evaluation.

Solution Briefs and pitches will be evaluated based on the following evaluation criteria:

a. Feasibility – solution is technically possible. This criterion measures whether the technology exists or is likely to be developed in the scope of this prototype effort.

b. Viability – solution is compatible with DoW constraints, technical environments and other organizational requirements. This criterion measures whether DoW could easily adopt the prototype.

c. Desirability – solution is responsive to the problem statement and desired solution objectives. This criterion measures whether end users are likely to adopt the offeror’s prototype solution. An example of something which is not desirable is a software (SW) solution that is not intuitive/easy to use and requires extensive training for use/operations.

d. Technical Merit: The Government will evaluate the Offeror’s proposed solution/concept relevance to the respective Topic; innovation or a potential capability; solves a capability/gap/problem or provides potential innovative technological advancements;

e. capabilities and scalability of the solution; benefits of the solution/concept; and technical approach.

f. Schedule. The Government will evaluate the proposed solution/concept project schedule and maturity path.

g. Price. The Government will evaluate the reasonableness and affordability of the proposed rough order of magnitude (ROM), to include the estimated out-the-door total cost/price.

Definition Does Not Provide Sufficient Information to Evaluate

The solution brief lacks enough detail or clarity to determine compliance with requirements. Key elements are missing, incomplete, or ambiguous.

Fails to Meet Minimum Requirements

The solution brief can be evaluated but does not satisfy one or more of the basic, mandatory requirements. It is not acceptable in its current form.

Meets Minimum Requirements The solution brief fully meets all required criteria but does so only at a basic level.

Meets Requirements and Exceeds Some

The solution brief meets all requirements and includes enhancements or added value in one or more areas.

Far Exceeds Requirements The solution brief greatly surpasses all requirements. It offers exceptional quality, innovation, or value with clear, substantial benefits.

8.0 Intellectual Property (IP)

8.1 The Government will have unlimited rights to plans and system designs related to this project.

8.2 The Government unlimited rights to use, modify, and distribute the technical solutions for government purposes, including procurement and sustained activities.

9.0 Foreign Ownership and Control; Foreign Access to Technology

9.1 The Responder shall provide details of any foreign ownership or control that may exist within their corporate structure.

9.2 The Responder shall have the ability to create and store export-controlled data in accordance with export control regulations.

10.0 Follow-On Production

Companies should be advised that any prototype Other Transaction (OT) agreement awarded in response to this Call for Solutions may result in the award of a follow-on production contract or transaction without the use of further competitive procedures. The follow-on production contract or transaction will be available for use by one or more organizations in the DoW, and as a result, the magnitude of the follow-on production contract or agreement could be significantly larger than that of the prototype OT. CDAO requests a production Rough Order of Magnitude (ROM).

As such, any prototype OT will include the following statement relative to the potential for follow-on production: "In accordance with 10 U.S.C. 4022(f), and upon a determination that the prototype project for this transaction has been successfully completed, this competitively awarded prototype OT may result in the award of a follow-on production contract or transaction without the use of competitive procedures.

11.0 Notes

• Offerors are responsible for monitoring SAM.gov for any amendments to this solicitation that may have updated information.

• The Government will give preference to submissions that demonstrate an innovative, existing, and reference-verifiable commercial ability to accomplish the desired solution attributes listed above.

• Resellers and academic research proposals are not desired.

• Contractors with appropriate non-disclosure agreements and non-competes may serve as advisors to the source selection panel.

• All solution briefs will be valid for 180 calendar days after the submission date.

• The Solution Brief must identify any intellectual property involved in the effort and associated restrictions on the Government’s use of that intellectual property.

• The Government reserves the right to go directly from Solution Brief to award.

• The Government reserves the right to award more than one (1) award resulting from this Call for Solutions or to make no award.

• Submission of proposal does NOT guarantee award.

• Completion of prototype does NOT guarantee follow-on production contract.

12.0. General Information/Questions

General inquiries related to this Call for Solutions may be directed to the Agreements Officer and Specialist (POCs) listed in this Call for Solutions.

Any questions for consideration during the virtual Q&A session to be held on or about 12 February 2026 must be submitted to the email address usarmy.adelphi.devcom-arl.list.nextgenSUNet@army.mil by 2:00pm ET on 10 February 2026.