2025.08.13 CSO 001 QA.pdf

CUI

Source Selection Sensitive - See FAR 2.101 and 3.104

Source Selection Sensitive When Filled In

TRANSCOM25CS001

Reference Solicitation Document/Attachment Offeror Question/Comment Government Response

Example: Attachment 1 , PWS Please verify what the acronym "CP&CD" stands for

CSO Call 001 In order to consider a Rough Order Magnitude, can the USG provide a rough order of scope in terms of numbers of users, applications, data centers, cloud deployments etc.?

Amendment 1 to the CSO updates the ROM requirement to allow a pricing model per user, app, etc. if a ROM is not possible.

CSO Call 001 Is the Government looking for a ROM for a prototype or full production deployment? The Government is looking for a ROM for a full production deployed solution or a prototype.

CSO Call 001 Is the desired solution deployed as a service, Government Owned - Government Operated, or Government Owned - Contractor Operated?

Solutions can be any of the above, but must have the appropriate approvals and functionality between various impact levels (i.e. IL5/6 for cloud services)

CSO Call 001 Has USTRANSCOM formally completed an 'As-Is' (current environment) and 'To-Be' (Target and Advanced level) Zero Trust architecture assessment for its IT infrastructure? Yes, but results are not releasable due to the classified nature of the information.

CSO Call 001

Could USTRANSCOM please detail the specific requirements and certifications necessary for a solution to achieve a DoD provisional authorization, including the process for vendors to obtain it? Additionally, will a Certificate to Field or similar be required for all proposed technologies?

The ability to self-host on the unclassified and classified side will eliminate the need for a DoD PA. Cloud authorization process can be found here: https://www.cyber.mil/dccs/dccs-documents/ Certificate to Field will not be required for all proposed technologies.

CSO Call 001

USTRANSCOM mentions the need for solutions to support diverse agile deployment methodologies, including CI/CD. Could you please specify any preferred CI/CD tools, practices, or frameworks that USTRANSCOM expects these solutions to integrate with?

Please refer to the "Modern Software Practices" section of the DoD CIO Library to better assist you in developing your solution. Particularly the Tools & Activities Guidebooks and Ref Designs:

(https://dodcio.defense.gov/library/) Software factory is based off the core components of AF Big Bang (https://p1.dso.mil/bigbang)

CSO Call 001 For different Areas of Interest (AoIs), what level of interoperability is expected between various vendor solutions? Will data exchange between these solutions necessitate trusted guards, gateways, or other controlled interfaces?

To achieve the objectives of the DoD's Zero Trust activities, interoperability must reach a level that allows for successful completion of associated activity outcomes. Interoperability is described in the associated DoD references.

CSO Call 001 For SIEM, what are the expected data retention policies for logs, alerts, signals, and data within the Cloud Services Offering, considering the need to minimize cost while ensuring high availability? The expected data retention in frozen storage is a minimum of 1 year.

CSO Call 001

For DevSecOps Platform Integration, Software Defined Perimeter (SDP), and API Management, USTRANSCOM's document states that integration with DoD Identity, Credential, and Access Management (ICAM) solutions is required. Could USTRANSCOM specify if DoD PKI and SIPRNet ICAM are mandatory for integration with the SDP and API Management solutions? Yes, they are mandatory.

CSO Call 001 Could USTRANSCOM provide insight into the current Attribute-Based Access Control (ABAC) systems in use across its unclassified and classified operating environments?

The DoD ZTRA and the DoD ICAM Reference Design describe the requirements for ABAC (https://dodcio.defense.gov/library/). USTRANSCOM utilizes Active Directory with ADFS. Additionally, USTRANSCOM uses a system that maintains over 200 user attributes that can be utilized by the different systems to achieve ABAC. These attributes typically define the scope of access for a user and are utilized in tandem with Role Based Access Control to provide fine grain authorization decisions. The attributes are passed from the authentication system in OAuth2 or SAML2 tokens. A few of the more widely used attributes are SCAC, GBLOC and DODAAC

CSO Call 001 For each AOI, is there a limit on the number of slides for the PowerPoint briefing? As stated in Attachment 1 of the CSO, there is a limit of 5 slides per AoI.

CSO Call 001

We have existing content to address the requested Zero Trust topics from other CSO offerings, however, those customers requested input in powerpoint format. Can we have the option to submit as either a 5 page white paper or a 5 page powerpoint?

As stated in Attachment 1 of the CSO, responses shall be submitted as a white paper with up to 5 pages in addition to a Powerpoint presentation with up to 5 slides.

CSO Call 001

The government is asking for a white paper (similar to requests for RFIs). Under RFI, the government allows 2-3 weeks to respond to 5 pages; in this case, they are requesting up to 30 pages due within one week. Due to the nature of possibly writing to 6 separate AoIs and the need to meet compliance requirements with ROM generation, can the government provide a two week extension to the August 12th deadline?

The Government posted Amendment 1 on SAM.gov extending the due date for AoI 1 - SIEM Solution to 14 August 2025 and all other AoI responses to 26 August 2025.

CSO Call 001 Can the Government provide guidance on how you want the response to be submitted if there is a solution that meets multiple AoI's? Shall we assume that a duplicate submission is what is expected?

If a solution meets multiple AoIs, it is acceptable to address that in a single AoI response. Duplicate submissions are not necessary.

USTRANSCOM Zero Trust Enterprise Modernization and Optimization

CSO Call 001 - Question and Answer Template

Source Selection Sensitive When Filled In

CSO Call 001

Potential bidders may be excluded from responding due to the lack of specific technical requirements (e.g. counts of devices, users, or environment data) and the short turnaround time to generate and validate a quality, useful ROM.

Additionally, we have responded to a number of other CSO initial responses and none of them have requested a ROM this early in the process. To encourage competition, can we exclude ROM submission in Phase 1?

The Government posted Amendment 1 on SAM.gov extending the due date for all AoIs. Additionally, Amendment 1 to the CSO updates the ROM requirement to allow a pricing model per user, app, etc. if a ROM is not possible.

CSO Call 001

While we recommend there not be a ROM required, as an alternative to the ROM and to facilitate potential bidders in providing some pricing response, would the Government consider providing pricing bins (i.e., <$100k, $100k-<$1M, $1M to < $5M, etc.)? This would allow a vendor to respond at this early stage that the solution presented would likely fall in "Bin 2", for example, providing the government a rough estimate with the minimal exchange of technical requirements. Another option could be a phase 1a ROM submission following the exchange of additional technical requirements. Amendment 1 to the CSO updates the ROM requirement to allow a pricing model per user, app, etc. if a ROM is not possible.

CSO Call 001 Can USTRANSCOM clarify how interoperability between solutions from different vendors across separate AoIs (e.g., SIEM, SOAR, SDP, Endpoint Security) will be evaluated, particularly in cases where no single vendor is awarded across all AoIs?

The Government is unable to provide an answer to how potential gaps in interoperability between solutions from various vendors will be resolved until such gaps are identified.

CSO Call 001 What specific functional and operational capabilities constitute an acceptable "minimum viable product" (MVP) to meet the 30-day post-award deployment expectation? A solution meeting DoD Target Level ZT capability is the MVP.

CSO Call 001

If a proposed solution includes integrations with commercial or proprietary third-party technologies (e.g., CrowdStrike, BigBang, AWS-native tools), how should the associated licensing be addressed in the ROM? Should vendors bundle licensing or assume government-provided enterprise licenses? The proposed solution should include any applicable licensing cost.

CSO Call 001 Does USTRANSCOM intend to conduct independent testing or sandbox evaluations of proposed solutions as part of Phase II or prior to any potential Phase III awards?

Government testing and evaluation is not applicable to Phase I; however, it may be requested for Phase II submissions.

CSO Call 001 Can USTRANSCOM clarify whether the existing IT environment is already operating in a hybrid/multi-cloud (Azure and AWS) configuration, or whether such infrastructure is expected to be deployed as part of the CSO solution?

The infrastructure is expect to be deployed as part of the CSO solution. These environments exist today but do not leverage the holistic Enterprise-wide solutions the Government is seeking.

CSO Call 001 Will past performance in non-DoD commercial environments be evaluated on equal footing with DoD-specific experience, particularly for non-traditional vendors or small businesses? Yes, Government and non-Government experience with similar efforts will be treated equally.

CSO Call 001 Are there any specific restrictions or expectations regarding the handling of data at various Impact Levels (e.g., IL5 vs. IL6) for log/event/telemetry data under each AoI? Yes, please see Cloud Security Requirements Guide here: https://www.cyber.mil/dccs

CSO Call 001 Can a joint submission from multiple teaming partners be submitted under a single AoI response, or must each entity submit its own independent solution? Yes, a joint submission is acceptable.

CSO Call 001 Should white papers emphasize prior deployments in operational DoD environments, or are relevant commercial deployments and test environments considered equally acceptable for demonstrating solution maturity? Relevant commercial and test deployments are equally acceptable.

CSO Call 001 Does USTRANSCOM have a preferred format or delivery method (e.g., virtual, embedded, asynchronous) for the training resources required to accompany each solution? Virtual delivery of training resources is preferred, but not mandatory.

CSO Call 001

In the document titled “Commercial Solutions Opening (CSO)-USTRANSCOM Information Technology (IT) Enterprise Modernization (ITEM) Solutions” under item #4 on page 14 of 20 it states, “Do not include corporate or personnel quals, past experience or supplemental info….” In the document titled, “Commercial Solutions Opening (CSO) Call 001” under Prior Demonstration and Usage it states “When applicable, companies should provide evidence demonstrating capability in relevant and/or representation environments and show experience in successful fielding. Can you please clarify if past performance experience is allowed within the white paper response. In this case, the CSO Call will take precedence. Past performance is allowed within the white paper.

CSO Call 001 AOI 5 What data types will be tagged? (Files, Databases, Emails, APIs, Structured/Unstructured) Data tagging will encompass Files, Databases, Emails, APIs, and Structured/Unstructured data.

CSO Call 001 AOI 5 Are tags applied automatically? (Yes/No/Partially) Solution will require the ability to apply tags automatically when appropriate.

CSO Call 001 AOI 5 What types of tags can the system apply? (Sensitivity, Context, Behavioral, Policy triggers) To support enabling robust Attribute-Based Access Controls (ABAC), the solution should support the application of multiple tag types including sensitivity, context, behavioral, and policy triggers.

CSO Call 001 AOI 5 Can tags be used to enforce security rules? (Encryption, Access Control, Alerting, TTL) Yes, tags can be used to enforce security rules.

CSO Call 001 AOI 5 What environments does the solution support? (On-prem, AWS IL4/5/6, Azure IL5/6, SECRET) The proposed solution should be able to support On-Premise, AWS, and Azure environments in impact levels 2, 4, 5, and 6.

CSO Call 001 AOI 5 What is the deployment model? (SaaS, On-prem, Hybrid, Containerized) The Government cannot provide an answer as your solution should address this.

CSO Call 001 AOI 5 Is an MVP deployable within 30 days? (Yes/No/Timeline) The CSO Call outlines a minimum viable product as soon as 30 days after award.

CSO Call 001 AOI 5 Which systems has this tagging solution already integrated with? (SIEM, SOAR, ICAM, PDP/PEP, DLP, Encryption engines) The Government cannot provide an answer as Data Tagging is an AoI. Your solution should address this.

CSO Call 001 AOI 5 Does it support real-time enforcement based on tags? (Yes/No/Details) The Government cannot provide an answer as your solution should address this.

CSO Call 001 AOI 5 Does it integrate with DoD authentication tools? (SAML, CAC, IdAM) Yes, the solution should integrate with authentication tools and Enterprise ICAM solutions CSO Call 001 AOI 5 What types of training are included or available? (Admin, User, Online, Instructor-led) The Government cannot provide an answer as your solution should address this.

CSO Call 001 AOI 5 Is training priced separately or bundled? For the ROM, training can be priced separately or bundled.

CSO Call 001 AOI 5 What support model is included? (Tier 1/2/3, 24x7/Business Hours) The Government cannot provide an answer as your solution should address this.

CSO Call 001 AOI 5 How are updates and patches delivered? The Government cannot provide an answer as your solution should address this.

CSO Call 001 AOI 5 What is the base software license model? (User, Device, Data Volume, Subscription) The Government cannot provide an answer as your solution should address this.

Source Selection Sensitive When Filled In

CSO Call 001 AOI 5 Estimated annual license cost The Government cannot provide an answer as your solution should address this.

CSO Call 001 AOI 5 One-time setup and integration costs (configuration, tuning, integration) The Government cannot provide an answer as your solution should address this.

CSO Call 001 AOI 5 Training session cost (if not bundled) The Government cannot provide an answer as your solution should address this.

CSO Call 001 AOI 5 Ongoing support and maintenance cost The Government cannot provide an answer as your solution should address this.

CSO Call 001 AOI 5 Optional or premium features not included in base pricing The Government cannot provide an answer as your solution should address this.

CSO Call 001 AOI 5 Has this solution been deployed in DoD environments? (IL4/5/6, SECRET) The Government cannot provide an answer as your solution should address this.

CSO Call 001 AOI 5 Used in commercial or regulated sector? (Yes/No/Details) The Government cannot provide an answer as your solution should address this.

CSO Call 001 AOI 5 What certifications does the product hold? (FIPS, NIAP, FedRAMP, etc.) The Government cannot provide an answer as your solution should address this.

CSO Call 001 We are preparing a Phase I submission and would like to get clarification on this requirement, which was not detailed in the instructions: (g) Non-Traditional Contractor Self-certification Statement

Please include a statement certifying the offeror meets the statutory definition of a non-traditional defense contractor as defined in 10 U.S. Code § 3014.

CSO Call 001

Is USTRANSCOM considering individual industry partners for each of the AoIs or is the command searching for a comprehensive “end-to-end” solution? The discrete AoIs suggest specialized offerings will be considered if supporting only a single area is possible, but I wanted to confirm before we get started on the deliverables.

We are considering both individual industry partners for each AOI or a comprehensive end-to-end solution from one company.

CSO Call 001 Can you please elaborate on the timeline? We see that Solutions Briefs are due on 12 August 2025, but in order for us to align internal resources with this effort it would be helpful to understand the anticipated award date. For AoI 1, SIEM, we are anticipating an FY25 award.

CSO Call 001

Are you able to provide any insight into the scope of budget for this effort? Should we consider Year 1 to be GFY2026? Is there appetite for getting started in GFY2025? We have a FFP pricing model that is very straightforward for Year 1, but having a better understanding of the budget will help us more accurately forecast future year spending. For AoI 1, SIEM, we are anticipating an FY25 award.

RFQ Q&A