CSO Call 002- Zero Trust_CFMS.pdf

Commercial Solutions Opening (CSO) Call 002 for

USTRANSCOM Zero Trust Enterprise Modernization and Optimization

Commercial Solutions Opening (CSO) TRANSCOM25CSO001 AoI Title Increasing Access to Data and Effective Knowledge

Management DoD Program Office United States Transportation Command

(USTRANSCOM)

Issued by USTRANSCOM / Acquisition Directorate Instructions

See the current version of TRANSCOM25CSO001, Attachment 1: Phase I – Documentation Submission Requirements

Solution Briefs Due 8:00 AM (CT) on Nov 3, 2025 Contracting Point of Contact Jeremy Howard

Contracting Officer Representative jeremy.s.howard.civ@mail.mil

Alicia M. Biekert Contracting Officer alicia.m.biekert.civ@mail.mil

CSO Point of Contact transcom.scott.tcaq.mbx.TCAQ-DS@mail.mil

Background:

The Department of Defense (DoD) is actively pursuing the Combined Joint All-Domain Command and Control (CJADC2) strategy to maintain a decisive advantage over adversaries. CJADC2 aims to provide commanders with a real-time, comprehensive understanding of the operational environment, enabling faster and more informed decision-making.

Achieving CJADC2's vision requires a fundamental shift in how the DoD manages and secures its information technology (IT) infrastructure. USTRANSCOM, as a critical component of this endeavor, must adopt a Zero Trust (ZT) security model and modernize its approach to Data, Assets, Applications, and Services (DAAS). This transition will necessitate a significant departure from traditional network and application architectures, impacting how DAAS are built, updated, delivered, protected, and accessed.

To accelerate ZT adoption, the DoD Chief Information Officer established the ZT Portfolio Management Office (PfMO) in January 2022 to streamline policies, prioritize resources, and drive implementation across the DoD Information Enterprise (DoD IE). The DoD ZT Strategy aligns with Executive Order 14028, the FY22 National Defense Authorization Act (NDAA), and the Federal Zero Trust Architecture Strategy, reinforcing the urgency of this transition. Integrated with broader cybersecurity modernization efforts, including the DoD Cyber Strategy and DoD Zero Trust Reference Architecture (DoD ZTRA) v2.0, it guides Component-level execution. This shift requires rethinking traditional architectures, embedding ZT principles across network infrastructure, enterprise IT, National Security Systems (NSS), and embedded computing to enhance cybersecurity and mission resilience.

Problem Statement:

USTRANSCOM Acquisition (TCAQ) requires a secure, cloud-enabled contract file management solution aligned with Zero Trust Architecture (ZTA) to replace its fragmented legacy tools. The solution must provide comprehensive Contract Lifecycle Management (CLM), encompassing all stages from initial request to contract closeout. This CSO Call aims to address the critical need for comprehensive Enterprise ZT solutions, encompassing 91 Target Level activities and 61 Advanced Level capabilities as defined in DoD ZT overlays. The solutions shall be deployable across UNCLASSIFIED environments, in terrestrial data centers and multiple cloud environments (Azure, Amazon Web Services (AWS), and On-premises) at impact level 5 (IL5), be cloud-agnostic, and possess a DoD provisional authorization (if applicable).

Solutions shall support a variety of agile deployment methodologies (Continuous Integration and Continuous Delivery/Deployment (CI/CD)). In line with the FY2022 NDAA and DoD ZT strategy (https://dodcio.defense.gov/library/), USTRANSCOM seeks innovative commercial solutions to achieve full ZT compliance across its IT portfolio.

USTRANSCOM is requesting Phase I submissions (to include PowerPoint Briefing and White Paper) for the AoI below. This AoI will be submitted independently from other AoIs.

The AoI will focus on specific ZT capabilities:

AoI 1: Contract File Management Solution

The above AoI white papers must describe how their solution will integrate with other potential AoI solutions identified in this call and the infrastructure described in each AoI. Additionally, describe training resources available to the Government for the provided solutions.

Solution Attributes:

A. AoI 1: Contract File Management Solution

Core functionality must include automated workflows for routing, approvals, and notifications, along with secure document management capabilities for version control and retrieval. The solution must generate comprehensive reports on contract performance, compliance, and resource utilization, seamlessly integrating with existing USTRANSCOM systems for data analytics.

The solution must enforce Multi-Factor Authentication (MFA) for all users and implement granular Role- Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) to restrict data access based on roles and responsibilities. The solution must be capable of securely storing, processing, and transmitting Controlled Unclassified Information (CUI) and Personally Identifiable Information (PII) in accordance with the applicable Information Level (IL) requirements, including appropriate encryption and access controls. The solution must provide secure and well-documented Application Programming Interfaces (APIs) to facilitate seamless integration with other systems, enabling automated data exchange and workflow orchestration. These APIs must adhere to industry best practices for security and authentication and must support modern data exchange formats. Continuous security monitoring and user behavior analysis are essential for proactive threat detection and incident response. Regular vulnerability scanning and penetration testing must be conducted. The solution must provide Software Supply Chain Security to validate the security of third-party components.

Regulatory compliance mandates adherence to all applicable regulations, including FAR, DFARS, and USTRANSCOM Agency Operating Instructions. The solution must also provide comprehensive support for records management, ensuring full compliance with National Archives and Records Administration (NARA) guidelines and policies, as well as meeting Section 508 accessibility requirements.

The solution must be scalable to meet the evolving needs of TCAQ and maintain optimal performance under peak load. Data Governance capabilities, including data tagging and data classification, are required.

Solution Maturity:

The Government will solicit potential solutions for the AoI. Only complete solutions for the AoI will be accepted. Solutions should be sufficiently mature and may be expected to be deployed as a minimum viable product as soon as 30 days after award. Partnerships and teaming arrangements are encouraged.

Only complete solutions will be accepted; partial solutions will not be considered.

Prior Demonstration and Usage:

When applicable, companies should provide evidence demonstrating capability in relevant and/or representative environments and show experience in successfully fielding solutions into operations. White papers should annotate to what extent specifications and attributes included in the White Paper have been verified (e.g., usage in commercial environments, testing within academia, etc.).

Companies currently performing on an existing DoD contract should highlight the unique, innovative, and/or previously under-utilized aspects of their solution submitted in response to this area of interest to be considered for an award.

Intellectual Property

At a minimum, USTRANSCOM anticipates acquiring Intellectual Property:

In any software delivered, commercial licenses customarily provided to the public; and, Technical data on the solution:

o Necessary for operation, maintenance, or training; and, o That describes the required overall physical, functional, and performance characteristics (along with the qualification requirements, if applicable) of an item, component, or process to the extent necessary to permit identification of physically- and functionally-interchangeable items. This is often called “form, fit, and function” data (see 48 C.F.R. § 252.227-7015(a)(3)).

Procedures:

Any award resulting from this CSO Call shall be in accordance with the CSO procedures detailed in TRANSCOM25CSO001. The instructions in the CSO, and any additional instruction as specified in this CSO Call posting, must be followed. The Government intends to conduct this CSO Call in two or three phases as detailed in the CSO.

Response:

White papers and associated PowerPoint briefings submitted in response to this CSO Call shall be submitted to the Contracting POCs identified NLT than 8:00 AM (CT) on 3 November 2025.

In addition to the submitted white paper(s) and PowerPoint briefing(s), the Government requires a Rough Order of Magnitude (ROM) outlining each projected AoI cost.

The Government may extend the response date by amending this CSO Call. Companies are responsible for monitoring SAM.gov for amendments to this CSO Call posting.

Questions:

Questions should be sent to the Contracting POCs listed, no later than 10:00 AM (CT) on 22 October 2025. Please be advised, submitted questions and answers may be posted to SAM.gov.