CALL FOR SOLUTIONS

Capability Program Executive Intelligence and Spectrum Warfare (CPE ISW) Project Griffin- Intelligent Response and Orchestration Node

Call Reference Number CPE ISW-CFS-26-001

Army Open Solicitation (AOS) Number W9128Z-25-S-A002

Call for Solution Title Project Griffin Intelligent Response and Orchestration Node (IRON)

Requiring Activity CPE ISW

Issued By Army Contracting Command – Aberdeen

Proving Ground (ACC-APG), Division C

Submission Instructions To respond to this Call for Solution, please refer to Sections 6 of this Call for Solution

*Solution Briefs Due Date/Time (Suspense)

27 August 2026, 1700 hours, Eastern Time

Point of Contracts (POCs) for Solution Brief Submission

Contracting/Agreements Officer Mr. Eric Pyles, eric.c.pyles.civ@army.mil

Contract Specialist MAJ Bryan Harrison, bryan.h.harrison2.mil@army.mil

Note 1: Please advise the Contracting Office as soon as possible via the Microsoft Forms link if your organization intends to submit a Solution Brief in response to this Call for Solution. The Forms link can be found in the “Links” section of the SAM.gov posting.

Note 2: Any submissions received by the Contract/Agreement Officer after the suspense date/time listed above will be deemed late and not evaluated. It is the sole responsibility of the offeror to ensure that its submission is received in the inbox listed above before the deadline specified.

mailto:eric.c.pyles.civ@army.mil mailto:bryan.h.harrison2.mil@army.mil

1. BACKGROUND.

As part of the Principal Cyber Advisor’s Army Rapid Development of Cyber Defense Systems (ARDS) Artificial Intelligence (AI) Tabletop Exercise (TTX) Program, the U.S.

Army is seeking industry partners for Project Griffin, one of the three current lines of effort to ARDS. The objective of Project Griffin is to build an autonomous, AI-driven capability called Intelligent Response and Orchestration Node (IRON). The IRON capability to Project Griffin will serve as the core decision-making context filter that automates "Take Action" cyber defense activities on the Army’s portion of the Department of War Information Network (DoWIN). When malicious cyber actor behavior or anomalous conditions meet specified thresholds, IRON will analyze context and enforce policies to execute rapid, automated responses via established Policy Enforcement Points (PEPs).

Currently, Army sensors generate vast amounts of logs and information feeds. Under a Zero Trust orchestration model, this data must be rapidly synthesized to protect the network. The envisioned IRON solution will sit at the analytic layer as a command-and-control node (Policy Decision Point / Context Filter). It will consume feeds from regional Unified Security Information and Event Management (USIEM)s and sensors, utilize advanced agentic AI to determine criticality, and direct appropriate actions. The physical enforcement of these actions will be executed by existing PEPs (e.g., Tychon, Microsoft Defender, Intune, Elastic Defend, Endpoint Context Manager). All automated actions must be concurrently documented in ticketing systems (e.g., Army Enterprise Service Management Platform (AESMP) /Rally) under a designated "automated" category.

2. PROBLEM STATEMENT.

The U.S. Army's cybersecurity infrastructure generates a massive volume of data from numerous sensors, making it difficult for human analysts to rapidly synthesize information and respond to threats in a timely manner. This delay creates a critical window of vulnerability for malicious actors to exploit the Army's network. To address this, the Army requires an autonomous, Agentic AI-driven system that can:

• Ingest and analyze security alerts from various sources in near real-time.

• Intelligently distinguish between genuine threats and false positives.

• Automatically execute defensive actions, such as isolating hosts or blocking malicious traffic, by integrating with existing security tools.

• Maintain a complete and automated audit trail by creating and updating service tickets for every action taken.

Essentially, the core problem is the lack of high speed, automated decision-making, and response capability to effectively neutralize cyber threats at machine speed.

3. REQUIRED SOLUTION ATTRIBUTES.

CPE ISW is seeking an AI-driven platform to deliver independent and modular capabilities that fulfil all core business objectives:

a. Contextual Analysis: Ingesting and evaluating meta-tagged alerts from sensors and USIEM.

b. Agentic Decision Making: Utilizing AI to validate true-positive anomalies and determine the most appropriate system to execute defensive activities.

c. Automated Action Execution: Seamlessly triggering external PEPs via Application Program Interfaces (APIs) or Simple Network Management Protocol (SNMP) commands to isolate hosts, update Access control List (ACLs), or patch vulnerabilities without manual intervention.

d. Closed-Loop Ticketing: Automatically creating, updating, and resolving historical/troubleshooting tickets for every action taken.

e. Government Defined Thresholds: The solution must provide a user interface for DoW/Army administrators to manually set, adjust, and audit the 'confidence thresholds' that dictate Tier 1 through Tier 4 response levels.

f. Defined “Kill Switch” Metrics: The master kill switch must halt all pending Tier 3 and Tier 4 autonomous actions across all integrated PEPs within [e.g., 5 seconds] of activation.

g. Utilize Open API Standards: All integrations with Sensors and Policy Enforcement Points (PEPs) must utilize open standards (e.g., RESTful APIs, JSON, STIX/TAXII) to ensure future extensibility.

h. Fail-Safe Posture: If IRON loses connectivity to a PEP, or if a PEP returns an error code during a Tier 3/4 action, the system must automatically downgrade the action to Tier 1 (Inform) and alert the SOC watch floor.

i. Automated Rollback: The solution must feature an automated, one-click 'Rollback' or 'Undo' function for all Tier 3 and Tier 4 actions, allowing an analyst to instantly reverse a PEP command (e.g., un-isolating a host or lifting an IP block).

Required Use Case Functionality: The IRON solution must successfully demonstrate capabilities across as many of the following seven distinct workflows as possible. The proposal of other workflows is acceptable:

a. Firewall Blocks: Detect anomalous events, immediately implement temporary firewall blocks via PEPs, and create/update corresponding tickets in AESMP/Rally.

b. Firewall Block Verification: Validate implemented firewall blocks through subsequent event analysis and automatically update the associated ticket with verification data.

c. Unified Security Information & Event Management (USIEM) Tuning:

Agentically poll the SIEM to analyze alerts, winnowing events to filter out false positives and identifying true anomalies that require secondary enforcement actions. Provide the ability to direct/recommend pruning action to remove unnecessary logs, not relevant fields in ingested logs, log enrichment recommendations, and/or fine-tuning detection rules.

d. C2 Beaconing Detection: Examine Zeek traffic logs or Domain Name

System (DNS) logs to identify tunneling behaviors, and trigger Tychon (or an equivalent PEP) to isolate the affected host and mitigate the threat.

e. Cloud-Based Internet Isolation, Secure Web Gateway, Break and Inspect

(CBII SWG B&I) Response: Leverage access to the CBII (Menlo) cloud-native secure web gateway (SWG) to analyze HTTP traffic on the Global Network (GN) for Indications of Compromise (IoCs) while navigating privacy-sensitive data that is available within the workflows. The purpose is to take appropriate action such as submit a ticket or directly insert a firewall block as appropriate.

f. Anomalous Server Activity: Ingest alerts of anomalous server activity from a sensor, generate a comprehensive ticket, and direct a PEP to execute automated policy enforcement based on the discovery.

g. Proactive Patching Response: Consume Threat Intelligence Reports highlighting critical vulnerabilities (CVEs) with available Proof of Concepts.

Respond by querying the Nessus Security Center API for compliance data, and proactively patch or update the vulnerable server via an Ansible controller.

Integration Environment: The IRON capability will be integrated at Network Enterprise Technology Command (NETCOM) with support from Army Cyber Command at the IL5 level, can be cloud based or on prem. The solution must demonstrate interoperability with the Army's existing cybersecurity stack, including but not limited to:

a. Sensors/Feeds: USIEM (Elastic), GN, Zeek, DNS logs, Nessus Security Center, Menlo cloud-native secure web gateway (SWG) and Gabriel Nimbus hosted data and services.

b. Policy Enforcement Points (PEPs): Tychon EDR, Microsoft Defender, Intune, Elastic Defend, Endpoint Context Manager (ECM), C2C layer 2 systems, and Ansible controllers.

c. Ticketing & Service Management: AESMP (ServiceNow), Rally.

4. AWARDING INSTRUMENT

The Call will be awarded in accordance with the Army Open Solicitation procedures detailed within Solicitation W9128Z-25-S-A002, found on SAM.gov. The Government intends to award Revolutionary FAR Overhaul (RFO) Federal Acquisition Regulation (FAR) Part 12, Firm-Fixed-Price (FFP) type contract(s) as a result of this Call; however the Government also reserves the right to award Other Transaction(s) (OT) for Prototype Project(s) pursuant to 10 U.S.C. § 4022. The Government further reserves the right to award to all, some, or none of the companies who submit proposals. This Call for Solution will utilize Commercial Solutions Opening (CSO) procedures. Use of a CSO in accordance with RFO DFARS subpart 212.70 is considered to be a competitive procedure for the purposes of 10 U.S.C. chapter 221 and RFO FAR subpart 6.101. The Government reserves the right to re-open this CFS and leave open on an on-going basis for on-ramping of additional offerors as desired.

5. GENERAL SOLICITATION NOTES

In addition to the general guidelines included in the open solicitation, the following guidelines apply to this Call for Solution:

• Offerors are responsible for monitoring SAM.gov for any amendments to this solicitation that may have updated information.

• Resellers and academic research proposals are not desired.

• All Solution Briefs will be valid for 180 calendar days after the submission date.

• The Government may down-select potential awardees under this call for solution.

• The Government reserves the right to issue multiple awards from this Call for Solution. It similarly reserves the right to refrain from making any award.

• Submittals must use a standard, readable font (i.e., not requiring magnification), as the document's readability directly impacts the Government's ability to assess the merits of the proposed solution. Offerors are strongly encouraged to use diagrams, graphics, and concise text to effectively convey complex information.

For this purpose, landscape-oriented (11 x 8.5 inch) pages are permissible for visuals but will be counted toward the total page limit, which is strictly enforced.

Any pages submitted beyond the maximum allowed will be removed by the Government and will not be evaluated.

• The Government may utilize internal Artificial Intelligence (AI) tools to assist in the administrative review and analysis of proposals, such as by summarizing content or verifying compliance with solicitation requirements. However, the use of AI is strictly for support purposes; all final evaluation judgments, the assignment of ratings, best value determinations, and the ultimate source selection decision are inherently governmental functions that will be made exclusively by Government personnel. The Government is committed to protecting all offeror proprietary and source selection sensitive information, and any AI tool used will operate in a secure environment, consistent with all applicable data protection regulations, and will not transmit data to external systems.

5.1 Overview of Submission Phases

The response process for this Call will generally consist of the following phases:

The Government is interested in unique and innovative solutions, including techniques to reduce costs, improve efficiency, and enhance performance. The Government will utilize up to three(3) phases for assessing solutions:

Phase 1 – Solution Brief:

For Phase 1 of this acquisition, offerors shall submit a Solution Brief. The brief is a written technical submission that must provide a detailed discussion explicitly addressing the technical merit of the commercial solution offering with respect to the problem statement defined herein, using the content guidelines in Section 6.1.

Furthermore, the submission must clearly articulate how the proposed solution meets the Government's objectives and satisfies the evaluation criteria detailed in Section 6.2.

All Solution Briefs will be evaluated against these criteria. Offerors are advised that the Government will not reimburse any costs incurred in the preparation or submission of a Solution Brief.

Phase 2 – Pitch Session (Unless Bypassed):

Offerors whose Phase 1 Solution Briefs that demonstrate technical merit, satisfy the minimum evaluation criteria, and are selected to proceed may be invited to participate in a Phase 2. Pitch Session. The Government reserves the right to limit the number of offerors invited to pitch. As such, an offeror’s solution may be evaluated to be of merit, however not invited to Phase 2.

If conducted, the Pitch Session may include a technical demonstration or challenge, Solution Proposal (Phase 3) and specific instructions will be provided to selected participants. The Government reserves the right to record all pitch sessions for evaluation purposes. Furthermore, the Government reserves the right, at its sole discretion, to bypass Phase 2 entirely and proceed to an award decision based on the Phase 1 submission. Unless otherwise stipulated, the Government will not reimburse offerors for any costs associated with preparing for or participating in the Pitch Session.

Phase 3 – Solution Proposal:

Following the completion of the preceding evaluation phase(s), the Government may issue an invitation to select offerors to submit a full Request for Solution Proposal (RSP). The invitation for Phase 3 will provide detailed instructions on the required format and content for the solution proposal submission. Unless otherwise stipulated, the Government will not reimburse offerors for any costs associated with preparing the Solution Proposal or engaging in any subsequent negotiations. Furthermore, offerors are advised that any potential award resulting from this solicitation is contingent upon the availability of Government funds and need.

Furthermore, the government reserves the right to combine Phase 2 and Phase 3.

General Notes

• Offerors are reminded that all awards are subject to the availability of funds and the Government reserves the right to make multiple awards, a single award, or no award as a result of this Call.

• Only a Contracting or Agreements Officer has the authority to enter into, modify, or execute a binding instrument on behalf of the United States Government. All payment obligations are subject to Congressional appropriations.

• In order to be eligible for award, offerors must:

o Possess a Unique Entity ID (UEI) and be registered in the System for Award

Management (SAM) prior to award, and maintain active registration throughout the period of performance.

o Register in the prescribed government invoicing system (e.g., Wide Area Work Flow (WAWF) contained in Procurement Integrated Enterprise Environment (PIEE) prior to award.

o Accurately represent their small business size and status as required.

o Be determined responsible by the Contracting/Agreements Officer and not be suspended, debarred, or otherwise prohibited from receiving an award.

o Disclose any actual or potential Organizational Conflicts of Interest (OCIs) to the Contracting/Agreements Officer prior to award.

• Offerors are responsible for monitoring SAM.gov for any amendments or updates to this Call.

• Notice to Offeror(s): The Government reserves the right to cancel this open Call, either before or after the closing date. If the Government cancels this open Call, the Government has no obligation to reimburse an offeror for any costs.

6. SOLUTION SUBMISSION REQUIREMENTS

6.1 Phase 1 – Solution Brief Content

Companies responding to this Call shall submit a Solution Brief for evaluation.

Submissions are to be sent via email only to the Contracting/Agreements Officer and Specialist (POCs) listed in this Call for Solution.

Solution Briefs shall follow the below-referenced page limits and Section 5 readability requirements to use a standard, readable font not requiring magnification.

Any pages exceeding the limit will be removed and not evaluated. The Government will not consider inserted textboxes/pop-ups or internet links to additional information as part of the Solution Brief and will not consider such information in its evaluation of submissions. Solution Briefs are intended to be clear, concise and succinct submissions.

The Solution Briefs shall include the following at a minimum:

a. Title Page (one-page limit)

i. Company Name, Call Title, Date, Point of Contact Name, POC Title, POC E-Mail Address, POC Phone, Address, and Call reference number. If registered in SAM.gov, include the Commercial and Government Entity (CAGE) code and Unique Entity Identification (UEI) code. Note: SAM registration is required for any award.

ii. Ensure to clearly identify the Call for which the Solution Brief is submitted.

b. High-Level Technology Solution/Concept (five-page limit)

i. Explain the unique technical aspects of your solution, its relevance to this Call, and how it is innovative or represents a potential capability. Highlight how the solution addresses the problem statement, required solution attributes, and required use-case functionality workflows.

ii. Describe the capabilities of your solution, its scalability, and the specific benefits it offers in relation to the objectives of this Call.

iii. Provide a detailed explanation of the technical approach, demonstrating its feasibility and achievability. Address how the solution will meet the Army’s hosting and security requirements, including whether an Authority to Operate (ATO) is currently held or able to be achieved. Include information about the technical team’s expertise and experience to successfully implement the proposed solution.

iv. Indicate whether the solution is an existing commercial technology or involves the development of technology for defense applications. Identify the DoD

Technical Readiness Level (TRL) and, if applicable, discuss the path to maturity for developmental or adapted technologies.

c. ROM & Schedule (Limit of one page for ROM, and one page for Schedule)

i. Rough Order of Magnitude (ROM): The ROM must contain the breakout of pricing. Tie pricing to milestones, where appropriate. Annotate assumptions used to develop the ROM.

ii. Notional Schedule: The notional schedule must contain a project schedule outlining major tasks, milestones, and/or timeline for delivering the proposed solution. Annotate assumptions used to develop the schedule.

d. Intellectual Property Statement/Agreement/Disclosures (no page limit)

i. The Solution Brief must identify any intellectual property associated with the proposed solution, and the associated restrictions on the Government’s use of that intellectual property. DFARS subpart 252.227-7017(d) may be used for formatting. As needed, include a separate disclosure for each company that would be a participant of the solution/concept.

6.2 Phase 2 – Pitch

Phase 2 submission requirements and evaluation criteria will be outlined in the invitation to this phase, unless bypassed.

6.3 Phase 3 – Proposal

Phase 3 submission requirements and evaluation criteria will be outlined in the invitation to this phase.

7. EVALUATION CRITERIA

7.1 Phase 1 – Solution Brief Basis of Evaluation

The Government intends to evaluate the Solution Briefs to determine if they have technical merit and address the Government’s problem statement and required attributes. Solution Briefs submitted IAW with this Call for Solution will be evaluated against the criteria in this Section. The Government reserves the right to use external market research in the evaluation of an Offeror. The Government reserves the right to select all, some, or none of the Solution Briefs submitted IAW this Call to proceed to subsequent phases.

a. Technical Merit: The Government will evaluate the Technical Merit of an Offeror’s Solution Brief. Technical Merit is defined as the solution’s direct relevance to the Call for Solution, its ability to address the problem statement and required solution attributes, and/or its potential to provide innovative technological advancements. As part of Technical Merit, the evaluation will consider the scalability of the solution, its benefits in relation to the problem statement and required attributes of this Call, and whether the technical approach is both feasible and achievable. Additionally, the Government will assess whether the proposed solution constitutes a compelling and innovative response to the Call for Solution.

If the Offeror’s solution is evaluated as not having Technical Merit, the Government reserves the right to not continue the evaluation for the remaining Evaluation Criteria, assigning an overall Solution Brief rating of ‘Not Selected for Further Consideration’.

At this time any solution that uses any DOW unauthorized ai platforms will be evaluated as not having Technical Merit.

b. Schedule. The Government will evaluate the Offeror’s proposed solution schedule, major tasks, milestones, timeline, and/or maturity path for feasibility and achievability.

c. ROM. The Government will evaluate the ROM for compliance with the Call’s instructions only. Cost and/or Price evaluation, and Fair and Reasonable Price determination, will not be performed on the ROM for Phase 1 evaluation.

d. Intellectual Property (Data Rights): The submitted IP and Data Rights assertions will be evaluated for compliance with this Call’s instructions.

7.1.1 Phase 1 - Solution Brief Selection Process

Based on the evaluation, the Solution Brief will be categorized as ‘Selected for Further Consideration’ or ‘Not Selected for Further Consideration’. Selection into the next Phase will be based on the criteria listed above, Government Need, and funding availability.

Selected for Further Consideration: The submitted Solution Brief has been determined to be of technical merit, represents a feasible and achievable schedule, and included all required submittals in accordance with the Call. As such, the Government intends to invite the Company to participate in next phase should funding be available.

Not Selected for Further Consideration: The submitted Solution Brief does not represent the necessary degree of technical merit, does not represent a feasible and achievable schedule, and/or did not include all required submittals in accordance with the Call.

Offerors ‘Selected for Further Consideration’ may be invited to participate in subsequent phases, subject to the availability of funds. The Government reserves the right to limit the number of offerors invited to Phase 2 – Pitch Session (unless bypassed) and/or Phase 3 – Solution Proposal. As such, an Offeror’s solution may be evaluated as ‘Selected for Further Consideration’, however, not invited to Phase 2 and/or Phase 3.

Solution Briefs, whether selected or not selected for subsequent Phases, will be notified in writing as soon as practicable of their evaluation results.

8. NON-GOVERNMENT ADVISORS

As stated in Section I1 of the AOS, non-Government advisors may be used in the evaluation of Solution Briefs, Pitch Sessions, and Solution Proposals, and negotiation of said Proposals. For this Call, the Government anticipates using non-Government advisor(s) from the following contractors:

No Non-Government Advisors are identified at this time. If Non-Government Advisors are deemed necessary post-Phase 1 evaluations, the Government will give advanced notice to the selected offerors.

If Non-Government advisors are deemed necessary, they will have signed non-disclosure agreements (NDAs) with the Government. By submitting a Solution, the Offeror understands that the Government may share proprietary Company information with the identified non-Government advisor(s) for evaluation and administrative purposes only. In addition, the Offeror further understands that it has an opportunity before submitting a Solution Brief to the Government to enter an NDA directly with the Non-Government advisor(s), and therefore waives all claims against the Government for any disclosures of proprietary information by the non-Government personnel. Such NDAs are the responsibility of the Offeror, and the Government shall not be a party to them. Companies shall provide a copy of the signed NDAs to the Government with submissions.

1Attachment titled “Army Open Solicitation_3 December 2025.pdf” on the main AOS SAM.gov posting.