CSO Call 001- Zero Trust.pdf

Commercial Solutions Opening (CSO) Call 001 for

USTRANSCOM Zero Trust Enterprise Modernization and Optimization

Commercial Solutions Opening (CSO) TRANSCOM25CSO001 AoI Title Increasing Access to Data and Effective Knowledge

Management DoD Program Office United States Transportation Command

(USTRANSCOM)

Issued by USTRANSCOM / Acquisition Directorate Instructions

See the current version of TRANSCOM25CSO001, Attachment 1: Phase I – Documentation Submission Requirements

Solution Briefs Due 10:00 AM (CT) on Aug 12, 2025 Contracting Point of Contact Jonathan Severin

Contract Specialist jonathan.a.severin.civ@mail.mil

Meggan A. DeBrobander Contracting Officer meggan.a.debrobander.civ@mail.mil

CSO Point of Contact transcom.scott.tcaq.mbx.TCAQ-DS@mail.mil

Background:

The Department of Defense (DoD) is actively pursuing the Combined Joint All-Domain Command and Control (CJADC2) strategy to maintain a decisive advantage over adversaries. CJADC2 aims to provide commanders with a real-time, comprehensive understanding of the operational environment, enabling faster and more informed decision-making.

Achieving CJADC2's vision requires a fundamental shift in how the DoD manages and secures its information technology (IT) infrastructure. USTRANSCOM, as a critical component of this endeavor, must adopt a Zero Trust (ZT) security model and modernize its approach to Data, Assets, Applications, and Services (DAAS). This transition will necessitate a significant departure from traditional network and application architectures, impacting how DAAS are built, updated, delivered, protected, and accessed.

To accelerate ZT adoption, the DoD Chief Information Officer established the ZT Portfolio Management Office (PfMO) in January 2022 to streamline policies, prioritize resources, and drive implementation across the DoD Information Enterprise (DoD IE). The DoD ZT Strategy aligns with Executive Order 14028, the FY22 National Defense Authorization Act (NDAA), and the Federal Zero Trust Architecture Strategy, reinforcing the urgency of this transition. Integrated with broader cybersecurity modernization efforts, including the DoD Cyber Strategy and DoD Zero Trust Reference Architecture (DoD ZTRA) v2.0, it guides Component-level execution. This shift requires rethinking traditional architectures, embedding ZT principles across network infrastructure, enterprise IT, National Security Systems (NSS), and embedded computing to enhance cybersecurity and mission resilience.

mailto:jonathan.a.severin.civ@mail.mil mailto:meggan.a.debrobander.civ@mail.mil mailto:transcom.scott.tcaq.mbx.TCAQ-DS@mail.mil

Problem Statement:

This CSO Call aims to address the critical need for comprehensive Enterprise ZT solutions, encompassing 91 Target Level activities and 61 Advanced Level capabilities as defined in DoD ZT overlays. The solutions shall be deployable across UNCLASSIFIED and SECRET environments, in terrestrial data centers and multiple cloud environments (Azure, Amazon Web Services (AWS), and On-premises) at impact levels 2, 4, 5, and 6, be cloud-agnostic, and possess a DoD provisional authorization (if applicable). Solutions shall support a variety of agile deployment methodologies (Continuous Integration and Continuous Delivery/Deployment (CI/CD)). In line with the FY2022 NDAA and DoD ZT strategy (https://dodcio.defense.gov/library/), USTRANSCOM seeks innovative commercial solutions to achieve full ZT compliance across its IT portfolio.

USTRANSCOM is requesting Phase I submissions (to include PowerPoint Briefing and White Paper) for each of the AoIs below. Each AoI will be submitted independently from other AoIs. Offerors may submit White Papers for all AoIs or select specific AoIs to reply to at their discretion.

Each AoI will focus on specific ZT capabilities:

AoI 1: Security Information and Event Management (SIEM) AoI 2: Security Orchestration, Automation, and Response (SOAR) AoI 3: DevSecOps Platform Integration, Software Defined Perimeter (SDP) and Application Programming Interface (API) Management AoI 4: Endpoint Security AoI 5: Data Tagging AoI 6: Software Supply Chain Risk Management (S-SCRM)

Each of the above AoI white papers must describe how their solution will integrate with other potential AoI solutions identified in this call and the infrastructure described in each AoI. Additionally, describe training resources available to the Government for the provided solutions.

Solution Attributes:

A. AoI 1: Security Information and Event Management (SIEM)

USTRANSCOM requires a single vendor/cloud agnostic SIEM platform that supports cross cluster query/search and replication. The architecture will create one single pane of glass for Cybersecurity Service Provider (CSSP) and DoD ZTRA capabilities. This platform will provide a low code machine learning capability to support advanced cyber defense methodologies as defined by DoD ZTRA and demanded by future cyber warfare projections. The SIEM will balance a need for high availability to support the mission while also keeping data in the Cloud Services Offering it was generated in; therefore, minimizing cost.

The SIEM shall aggregate and integrate environment logs, alerts, signals, and data from existing and future sources. Qualified SIEM solutions shall be capable of deployment within UNCLASSIFIED and SECRET environments, in terrestrial data centers and cloud, and support a variety of agile deployment methodologies (CI/CD). SIEM solution shall provide a robust analytics platform to support anomaly detection, normal baseline profiling, custom queries/visualization, and statistical analysis. Query execution and performance for one month of data shall be less than or equal to the following: 30 seconds https://dodcio.defense.gov/library/ for simple field lookups, 2 minutes for field correlations, 5 minutes for complex statistics and rare values, and 15 minutes for deep forensics with regex/wildcards.

Viable SIEM solutions shall ingest data from required sources including, but not limited to: Microsoft Azure, Amazon AWS, Microsoft Windows/Active Directory, Crowdstrike Falcon, Trellix Endpoint Security, Zeek, Tanium, Red Hat Linux, and modern SOAR platforms. Collection agents shall be lightweight with minimal performance impact presented to host. Consumed data shall be malleable and flexible to support customized data models to support cybersecurity and ZT requirements.

B. AoI 2: Security Orchestration, Automation, and Response (SOAR)

The SOAR requirement spans three critical categories of automation playbooks. First, orchestration for unsupervised, non-Cyber Robotic Process Automations (RPA) aimed at streamlining administrative and business processes, such as automating IT Service Management, report generation, and information sharing. Second, auto-mitigations through unsupervised, RPA that leverage high-fidelity data to mitigate threats without direct human intervention. Finally, augmentation represents supervised automation, where the SOAR system presents threat and mitigation information to an analyst for review and approval before execution.

The SOAR solution shall operate effectively within distributed, multi-cloud architecture encompassing Azure, AWS, and on-premises environments, necessitating either secure capability extension or dedicated SOAR instances per Operating Environment (OE). Large datasets shall reside primarily within their originating Cloud Service Offerings to reduce egress costs and network strain. The solution shall be scalable by leveraging cloud-native features.

The SOAR solution shall have strong API compatibility with existing security tools, advanced data analysis for threat identification (including anomaly detection and malicious behavior), effective alerting and notification based on threat severity, comprehensive reporting and compliance features, proven scalability to handle high data volumes, seamless integration with other security tools (e.g., Intrusion Detection and Prevention Systems, firewalls, endpoint protection platform), and a design rooted in strong security and privacy principles (e.g., encryption, strong access controls).

C. AoI 3: DevSecOps Platform Integration, Software Defined Perimeter (SDP) and Application Programming Interface (API) Management

The SDP shall provide the ability to dynamically and flexibly deploy network security perimeter functionality to isolate applications and services on unsecured networks. The SDP shall support Comply-to-Connect (C2C) solutions. The SDP shall provide an isolated, on-demand, and dynamically provisioned, trusted overlay that mitigates network-based attacks from both inside and outside the enterprise-controlled network. The SDP implementation shall hide assets from unauthorized entities, establish trust before allowing connections, and manage the system via separate control and data planes.

The SDP shall provide conditional authorization with micro-segmentation and encryption. While creating an end-to-end encrypted communication path, all data and applications shall be invisible from the public internet. Devices requesting access to resources shall pass a ZT-enabled SDP.

The SDP shall integrate with the potential SIEM solution resulting from the SIEM AoI, any DoD Identity, Credential, and Access Management (ICAM) solution, device hygiene attestations, and the ZT Policy

Decision Points (PDPs) and Policy Enforcement Points (PEPs) to specifically include the Application Programming Interface Management solution/gateways (APIM/API GW) and the DevSecOps Ecosystem (TCODE) built on DoD’s open source BigBang platform.

The APIM solution shall provide capabilities that support DoD ZT requirements for microsegmentation and resource authorization at the cluster, host, & process scope. The APIM gateway component shall preprocess incoming API requests and web service traffic, implementing robust web application firewall defenses. The gateway shall reject unauthenticated traffic or seamlessly redirect users to ICAM systems for proper authentication, ensuring no unauthorized access reaches protected resources.

The APIM gateway shall perform authorization checks based on defined security policies. The APIM policy framework shall be maintained as code through manifests in source control systems. Policy components and referenced attributes shall be dynamically evaluated in real-time by the APIM gateway.

The APIM solution shall integrate with standard DoD enterprise ICAM authentication protocols while providing comprehensive self-service capabilities for system owners and application developers. The toolset shall enable self-service registration of web applications, web services, and API endpoints, complemented by automatic API catalog enrollment, and advanced monitoring and diagnostic capabilities including API request tracing, authorization log review, access problem diagnosis, and security policy testing and verification. Encryption shall comply with National Security Agency cryptographic regulations, including Federal Information Processing Standards compliance and National Information Assurance Partnership certification requirements. The solution's architecture shall support centralized administration while maintaining operational resilience for web services deployed in environments degraded, disconnected, or with intermittent connectivity.

D. AoI 4: Endpoint Security

The Endpoint Security Solution shall establish comprehensive visibility, control, and automation across all endpoint environments, regardless of type or location. These tools shall automatically discover and inventory devices, offering a single pane of glass for managing security policies, monitoring activity, and responding to incidents. Centralized policy management and orchestration shall enable granular control based on various endpoint attributes, while seamless integration with cloud orchestration shall automate deployment and security of new devices. Remote management capabilities, automated threat remediation, continuous vulnerability scanning, and regular security assessments will further enhance operational efficiency.

Endpoint Security Solution tools shall leverage lightweight agents, cloud-native architectures, and efficient resource utilization. The solution shall utilize APIs to facilitate integration with other security tools, while forensic analysis capabilities shall enable in-depth investigations. Furthermore, these tools shall seamlessly integrate with the potential SIEM and SOAR solutions (see specific AOIs for requirement description), cloud provider security services, Identity and Access Management (IAM), and Network Access Control (NAC), creating a coordinated and comprehensive security ecosystem.

The solution shall support containers and serverless functions, ensuring comprehensive protection across all workloads. The solution shall leverage machine learning, behavioral analysis, and threat intelligence.

These tools shall implement Endpoint Detection and Response (EDR) capabilities, application control, and web filtering to further strengthen the security posture and prevent sophisticated attacks.

The Endpoint Security Solution tools shall integrate with a variety of security solutions, including antivirus, Next Generation Antivirus (NGAV), anti-malware, intrusion detection and prevention, application control, policy orchestration, behavioral analysis, Extended Detection and Response (XDR), Next Generation Firewalls (NGFW), data encryption, and Data Loss Prevention (DLP). These integrations will allow for a robust and layered security approach that is tailored to the specific needs of the organization.

The Endpoint Security solution shall meet the DoD’s criteria outlined in the Requirements Matrix found in Attachment 1.

E. AoI 5: Data Tagging

The data tagging solution shall classify and label data to enable granular access control, enhance data governance, and improve monitoring capabilities. The solution shall apply various tag types, including sensitivity (e.g., public, confidential), contextual information (e.g., origin, ownership), policy-based directives for automated enforcement, and temporal/behavioral indicators. The solution shall create tags that can be integrated directly with security policies to drive encryption, enforce attribute-based access control (ABAC), and facilitate continuous monitoring and auditing of data access and modifications. The solution shall enable enhanced data visibility. The solution shall provide robust data classification, emphasize automation for efficiency, and necessitate continuous monitoring and auditing of tagged data and access patterns.

F. AoI 6: Software Supply Chain Risk Management (S-SCRM)

S-SCRM shall identify risks of commercial and open-source software supply chains. It shall establish provenance of the source code, software products, and supply chain for unique software products. The solution shall also identify where the objectives of responsible parties’ conflict with those of the United States. It shall examine hygiene factors of software sustainment programs to ensure timeline correction of vulnerabilities. This combination of factors will result in a risk assessment report deliverable, which will then provide insight to assist in TRANSCOM's decision to authorize the use of third-party software products.

Solution Maturity:

The Government will solicit potential solutions for each AoI. Only complete solutions for each AoI will be accepted. Solutions should be sufficiently mature and may be expected to be deployed as a minimum viable product as soon as 30 days after award. Partnerships and teaming arrangements are encouraged.

Only complete solutions will be accepted; partial solutions will not be considered.

Prior Demonstration and Usage:

When applicable, companies should provide evidence demonstrating capability in relevant and/or representative environments and show experience in successfully fielding solutions into operations. White papers should annotate to what extent specifications and attributes included in the White Paper have been verified (e.g., usage in commercial environments, testing within academia, etc.).

Companies currently performing on an existing DoD contract should highlight the unique, innovative, and/or previously under-utilized aspects of their solution submitted in response to this area of interest to be considered for an award.

Intellectual Property

At a minimum, USTRANSCOM anticipates acquiring Intellectual Property:

• In any software delivered, commercial licenses customarily provided to the public; and,

• Technical data on the solution:

o Necessary for operation, maintenance, or training; and, o That describes the required overall physical, functional, and performance characteristics (along with the qualification requirements, if applicable) of an item, component, or process to the extent necessary to permit identification of physically- and functionally-interchangeable items. This is often called “form, fit, and function” data (see 48 C.F.R. § 252.227-7015(a)(3)).

Procedures:

Any award resulting from this CSO Call shall be in accordance with the CSO procedures detailed in TRANSCOM25CSO001. The instructions in the CSO, and any additional instruction as specified in this CSO Call posting, must be followed. The Government intends to conduct this CSO Call in two or three phases as detailed in the CSO.

Response:

White papers and associated PowerPoint briefings submitted in response to this CSO Call shall be submitted to the CSO POC at transcom.scott.tcaq.mbx.TCAQ-DS@mail.mil no later than 10:00 AM (CT) on 12 August 2025.

In addition to the submitted white paper(s) and PowerPoint briefing(s), the Government requires a Rough Order of Magnitude (ROM) outlining each projected AoI cost.

The Government may extend the response date by amending this CSO Call. Companies are responsible for monitoring SAM.gov for amendments to this CSO Call posting.

Questions:

Questions should be sent to Jonathan Severin, at transcom.scott.tcaq.mbx.TCAQ-DS@mail.mil no later than 10:00 AM (CT) on 06 August 2025. Please be advised, submitted questions and answers may be posted to SAM.gov.

Attachments

1. Endpoint Security Criteria Requirements Matrix