2025.11.03 Q&A.pdf

Question # Question Response 1 Is your environment currently FedRAMP M365 GCC G3, G5 or something else? If something else, please specify.

TRANSCOM currently uses M365.

2 What is anticipated to be the approximate number of users? TRANSCOM anticipates approximately 250 users and requires solutions to be scalable to accommodate potential growth or changes in 3 Will you provide remote access (via GFE laptop, ZTNA, etc.), for application development and ongoing support?

TRANSCOM will provide Government Furnished Equipment (GFE) where applicable for application development and ongoing support.

4 Do you provide access via contractor laptop via VPN/ZTNA, etc.? Please see answer to question 3.

5 Do you have process to upload files/documents/deliverables for review/installation/etc.? Solutions must support secure file/document upload processes.

6 Is there already a budget for this project – on what fiscal quarter? TRANSCOM's anticipated start is FY26.

7 Are you currently using a Zero Trust Network (ZTNA) solution or would like for us to include that in our response as well This should be excluded from the response.

8 Please confirm the scope for Area of Interest 1: full contract lifecycle management (intake through closeout) or contract file control with integrations to existing enterprise systems.

The scope for Area of Interest 1 is the full contract lifecycle management, from intake through closeout.

9 For Phase I down‑select, which demonstrations or artifacts will be scored (e.g., workflow from intake to award/mods, prioritized integrations, and a records handoff package)?

The submission will be evaluated in accordance with the evaluation criteria outlined in the original CSO TRANSCOM25CSO001 postin available on SAM.gov.

10 Will CFMS deploy in an existing Government Impact Level 5 (IL5) enclave, or may an IL5‑authorized software‑as‑a‑service boundary be used with control inheritance toward an authorization to operate?

Yes, Unclassified GovCloud (UGC) is IL5 with RMF rev 5 accreditation and inheritance available.

11 Should vendors propose day‑one multi‑cloud portability, or is a single IL5 cloud with a documented portability plan acceptable for Phase I?

A single IL5 cloud with a documented portability plan is acceptable for Phase I. Vendors should address how their solution would support future PACE plan requirements and provide a clear path to multi-cloud or multi-region deployment to achieve NSS compliance

12 If a Department of Defense Provisional Authorization exists, which mission‑owner overlays and additional assessments are expected for the Phase I minimum viable product?

TRANSCOM does not anticipate any additional mission-owner overlays or additional assessments for the Phase I minimum viable product.

13 Which Department of Defense Zero Trust Reference Architecture (v2.0) pillars and capabilities will be evaluated in Phase I, and which are deferred to later phases?

Phase I will evaluate foundational Zero Trust capabilities, including Multi-Factor Authentication (MFA), Role-Based Access Control (RBAC), secure APIs, data governance, and automated workflows to establish a secure baseline for the Contract File Management

14 Please confirm Identity, Credential, and Access Management expectations (e.g., Common Access Card / Personal Identity Verification, identity provider, conditional access). For access decisions, is policy‑as‑code Attribute‑Based Access Control required in Phase I, or are attribute‑conditioned access controls acceptable?

Identity, Credential, and Access Management expectations require the use of Common Access Card (CAC).

15 Please provide the authoritative attribute vocabulary for access control (e.g., organization, program, contract stage, Controlled Unclassified Information type) and the authoritative data sources.

Solutions should support flexible attribute-based access control.

16 Please confirm the tagging and classification scheme for Controlled Unclassified Information and Personally Identifiable Information and the required enforcement points (user interface, application programming interfaces, and exports).

Solutions must support tagging and classification for CUI/PII at user interface, API, and export levels.

17 What cadence is expected for continuous monitoring, user behavior analytics, vulnerability scanning, and penetration testing during Phase I and after, and who will perform penetration testing?

The expected cadence for continuous monitoring, user behavior analytics, vulnerability scanning, and penetration testing during Phase I and beyond should align with DoD Information Security Continuous Monitoring (ISCM) requirements as outlined in DODI 8530.01 and Risk Management Framework (RMF) controls CA-07 and RA-05 from NIST SP 800-53 r5, with penetration testing performed by

18 Does the evaluation require Software Bills of Materials and/or component attestation, and which formats (e.g., Software Package Data Exchange) are acceptable?

Software Bills of Materials (SBOM) and component attestation will be required for production deployment but are not required for Phase I evaluation. Vendors should be prepared to provide comprehensive SBOM documentation in subsequent phases.

19 Which Security Information and Event Management or other telemetry endpoints should receive audit and user behavior analytics logs?

Elastic and Splunk

20 Please list the initial external systems for Phase I integration (analytics, collaboration, financials, electronic signature, enterprise content management) and any required interface standards or security profiles.

Integration with TRANSCOM's data platform, currently Advana, and electronic signature systems are preferred.

21 Please provide any targets for API throughput, rate limits, and payload sizes to be used for Phase I design and performance testing.

The Government does not have predetermined API performance targets at this time. Offerors should propose appropriate API throughput, rate limits, and payload sizes based on industry best practices for contract management systems supporting approximately 250 users with the usage patterns described in previous responses. Proposed targets should be justified and scalable for future growth.

22 Should formal records retention and transfer be performed within CFMS or via an Impact Level 5 enterprise records platform integrated with CFMS? If applicable, please identify preferred transfer standards for the National Archives and Records Administration.

It is preferred that proposed CFMS be an approved NARA records management system for retention.

23 Which Section 508 artifacts are required for Phase I (e.g., an Accessibility Conformance Report / Voluntary Product Accessibility Template), and should usability tests with assistive technologies be included?

An Accessibility Conformance Report (ACR)/VPAT is required for Phase I. Usability testing with assistive technologies is not required for Phase I submission, but vendors should be prepared to conduct such testing in subsequent phases.

24 Please provide expected peak‑load scenarios (concurrent users, file sizes, search volume) and Service Level Objective / Service Level Agreement targets (latency and uptime).

Expected peak-load scenarios include 250 users, file sizes of approximately 5-10 MB, and a minimum uptime of 99.5% during business hours (7 AM - 5 PM, Monday-Friday).

25 Will government‑furnished sample contract files, metadata, and clause libraries be provided for Phase I, and is any production data migration expected?

No sample contract files will be provided during the solicitation phase; standard FAR-based contract files are used, clause libraries are managed in PIEE.gov via the Clause Logic Services module, and production data migration of existing contract files into the new system

26 What training deliverables are expected in Phase I (administrators, Contracting Officers, Contracting Officer’s Representatives, auditors), and is a train‑the‑trainer model acceptable?

A train-the-trainer model is acceptable, with training tailored to user roles; since the product includes pre-award requirements, training must extend beyond TCAQ and online recorded training is preferred.

27 Should the Rough Order of Magnitude provide separate entries for platform licensing, implementation, Impact Level 5 hosting, authorization support, integrations, records capability, and operations?

The Rough Order of Magnitude should be itemized with separate entries for platform licensing, implementation, Impact Level 5 hosting, authorization support, integrations, records capability, and operations.

28 Will this Commercial Solutions Opening proceed in multiple phases for this Area of Interest, and how will down‑select criteria be communicated between phases?

The CSO phases and notification are outlined in the original CSO TRANSCOM25CSO001 posting available on sam.gov.

29 Please confirm expectations for commercial off‑the‑shelf licensing and the scope of “form, fit, and function” technical data to be delivered.

Standard commercial licensing terms are acceptable for COTS solutions. The scope of required technical data will be limited to interface specifications, system documentation necessary for government operation and maintenance, and integration requirements. Detailed

30 Please confirm the question‑and‑answer deadline, the submission deadline, and the method of publishing answers (e.g., System for Award Management or email).

The question-and-answer deadline, submission deadline, and method of notification of any changes to these are outlined in the CSO Call posting available on SAM.gov.

31 The RFP mentions both "Contract File Management" and a "comprehensive Contract Lifecycle Management (CLM) solution." To confirm the full scope, are you expecting the solution to manage the entire end-to-end process (e.g., procurement request intake, contract authoring/drafting, negotiation, e-signature, post-award management like modifications and option years, and closeout), or is the primary focus on replacing the file repository with new workflows for document management and reporting?

We are seeking both Contract File Management (CFM) and Contract Lifecycle Management (CLM) capabilities in an end-to-end solution. However, contract creation (e.g., SF1449s, SF1155s, SF30s) is handled through PIEE.gov's Enterprise Contract Writing Module (ECWM). The CLM component should focus on administrative processes outside ECWM's contract writing functionality, 32 Could you detail the primary user personas (e.g., Contracting Officers, Program Managers, Legal, Administrators, external vendors) and the anticipated number of users in each role?

Additionally, what is the expected volume of new contracts per year and the total volume (size and file count) of legacy contract files that would need to be migrated?

Primary user personas include Administrative roles, Contracting Officers, Contracting Specialists, Legal, Technical Experts, Contracting Officer Representatives, Policy Reviewers, and Mission Partners. The expected volume is 1,000-1,500 actions per year, with approximately 2TB of legacy contract files requiring migration. The solution should be scalable to accommodate these roles and future growth.

33 "Automated workflows" is a key requirement. Could you provide a high-level overview of the 1 2 most critical business processes you aim to automate? For example, is the primary pain point the multi-stage review and approval of a new contract, or the process for tracking contract modifications and exercising options?

Primary automation should focus on automated routing and approval workflows that direct contract files to the appropriate roles based on contract characteristics and approval thresholds, and coordinated collaboration processes for pre-award and post-award contract actions/requirements that ensure proper review sequences and stakeholder involvement, with an emphasis on streamlining multi-stage review and approval workflows for new contracts and tracking contract modifications, including exercising options.

34 Regarding "secure document management," what are the specific version control requirements?

Does this imply simple major/minor versioning, or does it include more advanced features like document check-in/check-out, redlining/comparison, and collaborative editing?

Our secure document management requirements include both major and minor versioning with redlining/comparison capabilities and collaborative editing functionality. The solution should maintain complete version history while enabling multiple users to collaborate on documents with tracked changes and comparison features to review differences between versions.

35 To ensure appropriate sizing and scalability, can the Government provide specific metrics on expected usage, such as the total number of anticipated users (concurrent and total), estimated annual data volume growth, and the peak load requirements for critical business processes within TCAQ?

Please refer to the answers provided for questions 2 and 32.

36 Regarding the required Data Governance capabilities, can the Government provide a more detailed definition of the scope, including the specific data tagging and data classification standards (e.g., CUI, PII) that the solution must support?

The required Data Governance capabilities should include support for data tagging and classification standards such as Controlled Unclassified Information (CUI) and Personally Identifiable Information (PII). The solution must ensure compliance with applicable federal regulations and policies, including proper handling, storage, and access controls for sensitive data.

37 The solicitation mentions "agile deployment (CI/CD)." Does USTRANSCOM have an existing mandated CI/CD toolchain (e.g., Jenkins, GitLab CI, Azure DevOps)?

TRANSCOM UGC (Unclassified GovCloud) provides Gitlab with Runners and Artifactory for a pipeline.

38 The CSO states the solution must be cloud-agnostic. Can the Government clarify if a preference or requirement exists for targeting deployment on a specific cloud hosting provider (e.g., Azure AWS, Google Cloud) once the contract is awarded?

The solution must be cloud-agnostic; however, AWS is the initial target for deployment once the contract is awarded.

39 Regarding user access and accreditation, can the Government define the conditions under which external vendors will be permitted to access the Impact Level 5 (IL5) system? Additionally, is there a requirement for an Impact Level 2 (IL2) capability with cross-domain functionality (low-to-high or high-to-low), or is it assumed all users will be operating within the IL5 boundary, leveraging the agency's existing Identity Provider (IDP)/Multi-Factor Authentication (MFA) setup?

Day-to-day operations will be limited to government personnel only. External vendor access will be permitted during initial system creation, implementation, and data migration periods. Any vendor access requirements beyond the implementation phase will need to be determined and approved on a case-by-case basis. All users will operate within the IL5 boundary leveraging the agency's existing Identity Provider (IDP)/Multi-Factor Authentication (MFA) setup. No Impact Level 2 (IL2) capability or cross-domain functionality is required.

40 For MFA enforcement, does USTRANSCOM have an existing Identity Provider (IdP) and directory service (e.g., an existing SAML 2.0 or OIDC provider, perhaps tied to CAC/PIV authentication) that the solution must use for authentication and identity management?

Yes, USTRANSCOM has existing Identity Provider and directory services. The solution must integrate with our existing authentication infrastructure supporting CAC/PIV authentication. Specific integration details will be provided to selected vendors during implementation.

41 For Attribute-Based Access Control (ABAC), what are the key attributes you envision driving access rules? For example, is access to a contract file determined by the user's organization, the contract's dollar value, its classification (CUI/PII), or a combination of these?

File access will be based on standard government classification rules with role-based access control. Dollar value does not play a role in access decisions. Access control will be determined by user role and data classification as follows: Mission Partners/CORs require limite access when new requirements are initiated, Contracting and Legal teams require full access, and Finance personnel access will be grante on a case-by-case basis. The key ABAC attributes are user role/organization and data classification (CUI/PII), with workflow-based

42 How is CUI/PII data expected to be identified and handled? Is the expectation that users will manually tag documents and data, or is there a requirement for the solution to automatically identify CUI/PII within documents and data fields?

Contract files and acquisition documents are presumed to be CUI by default due to their procurement-sensitive nature. The solution should apply appropriate CUI handling and access controls to all documents, with manual tagging available for specific classifications or PII identification as needed.

43 What are the key external systems that this solution will need to integrate with? I.e:

Financial/ERP systems (e.g., for funding, obligations, or vendor data) E-signature platforms (e.g., DocuSign, Adobe Sign) The existing systems being replaced (for data migration)

The key external systems that this solution will need to integrate with include DLA GEX to access data from ECWM within the PIEE suite, as well as TRANSCOM's data platform, which is currently Advana.

44 Given the requirement for Zero Trust (ZT) compliance within the Impact Level 5 (IL5) environment, and recognizing that ZT implementation can vary, can the Government provide a detailed list of specific ZT requirements, mandates, and/or DoD ZT Target Level Activities (TLAs) that the solution must demonstrably comply with to meet agency standards?

The solution must comply with Zero Trust requirements within the IL5 environment as outlined in the DoD Zero Trust Reference Architecture. Vendors should reference the following publicly available DoD guidance for ZT requirements and Target Level Activities:

DoD Zero Trust Reference Architecture v2.0: https://dodcio.defense.gov/Portals/0/Documents/Library/(U)ZT_RA_v2.0(U)_Sep22.pdf

DoD Zero Trust Capabilities and Activities: https://dodcio.defense.gov/Portals/0/Documents/Library/ZT-CapabilitiesActivities.pdf 45 Concerning system integration via APIs, can the Government specify the required data exchange formats (e.g., JSON, XML, other schemas)? Furthermore, can the term "seamless integration" be defined in a technical context beyond the typical implementation of REST or SOAP APIs, particularly as it relates to automated data exchange and workflow orchestration?

The Government typically uses JSON and XML for data exchange formats. APIs should follow standard REST or SOAP protocols as appropriate. Regarding 'seamless integration,' we expect automated data synchronization, real-time or near-real-time data exchange, and workflow orchestration that minimizes manual intervention. Specific integration requirements, security protocols, and detailed technical specifications will be provided to selected vendors during implementation planning.

46 To clarify the required continuous security monitoring and User Behavior Analysis (UBA), can the Government provide a specific definition of the scope of UBA functionality expected? Also has a Secure Cloud Computing Architecture (SCCA) or equivalent system been identified by the agency to provide this level of security and monitoring functionality?

Please refer to the links provided in the answer to question 44 for information regarding requisite identity data necessary for ABAC-based adjudications for access management/access governance.

47 To meet NARA guidelines, what is the expectation for final records disposition? Do you have an existing, NARA-compliant Electronic Records Management (ERM) system for final disposition and archival? If so, what is the technology?

Please refer to the answer provided for question 22. Additionally, TRANSCOM has access to Content Manager, which is a NARA-compliant Electronic Records Management (ERM) system for final disposition and archival.

48 Are there any specific assistive technologies (e.g., a particular version of JAWS or NVDA) that are standard at USTRANSCOM and will be used as the benchmark for accessibility testing?

No, there are not currently any specific assistive technologies standard at USTRANSCOM that will be used as the benchmark for accessibility testing.

49 Will the Government please confirm that offerors can include a Table of Contents in White Paper responses that will not count against the page limitation?

The TOC will not count against the page limitation.

50 The CSO Call 002 states "The above AoI white papers must describe how their solution will integrate with other potential AoI solutions identified in this call and the infrastructure described in each AoI."

Will the Government please confirm that as this CSO Call 002 only addresses one (1) AoI (AoI 1: Contract File Management Solution), and there are no additional AoIs listed for this call, that offerors are not required to integrate other potential AoI solutions as part of our response to AoI 1?

There is only one AoI for CSO TRANSCOM25CSO001 Call 002.

51 Is it acceptable to deliver the solution on a SaaS no-code platform? No, it is not acceptable to deliver the solution on a SaaS no-code platform.

52 For the system(s) relevant to this CSO Call, can you approximate how many of the users would be Daily Active Users (DAU), weekly active users, or monthly active users?

Please refer to the answer provided for question 2.

53 For the system(s) relevant to this CSO Call, what is the approximate maximum number of contract actions would be actively monitored at any given time? Can TRANSCOM estimate the total cumulative dollar value of these contracts?

Please refer to the answers provided for questions 2 and 32. Information regarding the total cumulative dollar value of the contracts will not be provided.

54 Can the government confirm all solutions acquired under this CSO call are required to be IL5 compliant?

There is one AoI for CSO TRANSCOM25CSO001 Call 002, and all solutions acquired under this call must be IL5 compliant.

55 Approximately how many systems does TRANSCOM anticipate would be integrated with the proposed solution? For known integration points, can TRANSCOM provide existing API details for those systems, or DoDAF Artifacts (such an SV-4, CV-2 etc.) to details these integration points?

Core functional requirements are outlined in the CSO call, such as compliance with IL5 requirements, integration capability with existing systems, operational functionality for contract lifecycle management, and adherence to Zero Trust principles.

56 Can TRANSCOM confirm that they currently have access to all requisite identity data necessary to make ABAC-based adjutications for access management/access governance? If these attributes are not available, is TRANSCOM requesting that the respondent detail a plan to acquire these attributes?

The availability of requisite identity data for ABAC-based access control will not be assessed during Phase I implementation planning, as this depends on the specific attributes the selected solution requires. Vendors should propose their recommended ABAC attributes and include an approach for identifying and acquiring any necessary data that may not currently be available.

57 Does the 30 day MVP standup include acquiring necessary accreditation and approval of cloud access point connection?

Yes, the 30-day MVP standup includes acquiring necessary accreditation and approval of the cloud access point connection.

58 Can Government confirm they are seeking to retain intellectual property rights over the solution configuration and residing data, while leaving the commercial IP of the underlying solution or platform to be in the ownership of the provider?

Yes, the Government seeks to retain intellectual property rights over the solution configuration and residing data, while allowing the commercial intellectual property of the underlying solution or platform to remain with the provider.

59 Can TRANSCOM elaborate on the type of reporting attributes desired in the proposed solution or provide examples of reports currently used by TRANSCOM?

The solution must generate comprehensive reports on contract performance, compliance, and resource utilization, seamlessly integrating with existing USTRANSCOM systems for data analytics.

60 What is TRANSCOM's system of record for purchase requests or requisitions and is replacing that functionality in scope for this proposed solution?

TRANSCOM's system of record for purchase requests or requisitions is ECWM (Enterprise Contract Writing Module). Replacing the contract writing system is not within the scope of this proposed solution.

61 Can the Government confirm if contract-writing capabilities included in the legacy solution are to be replaced with the proposed solution?

Replacing the contract writing system is not within the scope of this proposed solution.

62 What metrics or criteria will define successful MVP delivery and transition to Phase II? Can the government provide DoDAF Artifacts such as CV-2, OV-5, and/or SV-4 that define core functionality for MVP?

Successful MVP delivery should be defined by core functional requirements outlined in the CSO call, such as compliance with IL5 requirements, integration with existing systems, operational functionality for contract lifecycle management and retention, and adherence to Zero Trust principles. The Government has not specified the provision of DoDAF artifacts; contractors should design solutions based

63 Given this effort is solicited under a CSO, and given the 30-day post award MVP deployment goal, does USTRANSCOM intend to use of standard COTS configurations and workflows rather than requiring extensive customization to mirror legacy processes?

Yes, USTRANSCOM intends to leverage standard COTS configurations and workflows to expedite deployment, with minimal customization, provided they align with applicable regulations and meet the requirements outlined in the CSO call.

64 Can you please share the current workflow and or technical solution that is used to today? The current workflow and technical solution used today includes, but is not limited to, a shared drive for file storage, email for communications, and Microsoft Teams for collaboration.

65 CSO states TCAQ uses fragmented tools. Can you disclose those tools? Please see answer to question 64.

66 Can you inform us what the recovery point of objective, recovery time of objective, and/or any availability requirements the solutions would require. Basically, how much resiliency the application need as it will influence the design.

Due to the critical nature of contract files, minimal data loss is required. We can accept an RPO of 1 hour, understanding that only data entered or modified within the hour preceding a disaster event would potentially be lost, while all existing contract files and historical data would be fully protected. For RTO, the system should be restored within 4 hours. We require 99.9% availability during business

67 The prior CSOs advertised solutions for SOAR, Software factory, SIEM, Data broker, Endpoint and so forth. Can you disclose those solutions or vendors to help with customizing our design towards USTC requirements? It will be challenging to design a specific ZTRA compliant platform without knowing the components of software factory and other solutions

TRANSCOM is not disclosing information regarding the solutions or vendors from prior CSOs, including those for SOAR, Software Factory, SIEM, Data Broker, Endpoint, and other components. Offerors are expected to design their solutions to meet USTRANSCOM requirements based on the information provided in the current solicitation.

68 Does your software factory or CI/CD pipeline have preferences toward front end/back-end languages or database storage architecture? Such as preferences or discouragements towards Oracle or PostgreSQL.

TRANSCOM will not specify preferences or discouragements toward particular front-end/back-end languages or database storage architectures, such as Oracle or PostgreSQL, for the software factory or CI/CD pipeline. Offerors should propose solutions that align with industry best practices and meet the requirements outlined in the solicitation.

69 What is the projected user requirement for this solution? Looking for something like 10 concurrent (max logged in at one time) users and a max of 100. A solution that supports 5 concurrent users will be designed uniquely over one that needs to scale out to 200.

The projected user requirement for this solution includes support for approximately 250 total users, with high concurrent usage expected during normal business hours, as the majority of contracting personnel are actively working in contract files throughout the day.

Additionally, during peak periods such as the End of Fiscal Year (EOFY) and New Fiscal Year (around October 1), the system must be capable of handling a large number of concurrent users simultaneously to accommodate increased activity. Solutions should be designed

70 What’s the total expected contract/document count that’d be migrated into this system currently? What’s the expected # of additional contracts/documents per month?

Please see answer to question 32.

71 Are workflows pre-determined and controlled or are workflows created/edited by end-users? We have identified the core business processes and workflow requirements, but the actual digital workflows have not been created yet.

We expect workflows to be primarily pre-determined and controlled by administrators to ensure compliance and consistency. However, users should have the ability to add additional reviewers to the approval process as needed for specific contracts or situations. We will work with the selected vendor during implementation to configure the necessary workflows based on our established business processes

72 Does USTRANSCOM already have an authentication /authorization solution encompassing

MFA/RBAC/ABAC?[

Yes, USTRANSCOM has existing authentication infrastructure using ADFS with SAML for CAC/PIV authentication and MFA capabilities. Role-based access control (RBAC) requirements are defined for different user types (Contracting, Legal, Mission

73 Will any of the fragmented legacy tools be required for integration? If so, do they have APIs? No, the fragmented legacy tools (shared drives, email, Teams) will not be required for integration.

74 What types of notifications would be in scope? (emails, Teams messages, in-app notifications?)Notification requirements are focused on workflow progression and task management. The system should notify users when contracts or documents are routed to them for action, when approvals are required, or when workflow status changes occur. Supported notification

75 Does the solution need to support in-app contract editing/authoring, or will that be done via desktop office products?

In-app contract editing/authoring is preferred; however, the solution must also support co-authoring and real-time collaboration capabilities.

77 How many existing systems does the Government anticipate integrating with the new contract management solution?

The Government anticipates integration will be required with PIEE(Procurement Integrated Enterprise Environment) and TRANSCOM's data platform, currently Advana.

78 How many users will utilize this new system? Please refer to the answer provided for question 2.

79 Can the Government please define the roles required (e.g. Contracting Officer, Contracting Specialist, etc.) and how many?

Please refer to the answers provided for questions 2 and 32.

80 Does the Government require licensing costs as part of the ROM estimate? Yes, the Government requires licensing costs to be included as part of the ROM (Rough Order of Magnitude) estimate.

81 Can the Government please clarify the requirements for the "Software Supply Chain Security" to validate security of third party components? Would a Software Bill of Materials (SBOM) address this need?

Software supply chain security is required for the solution. A comprehensive Software Bill of Materials (SBOM) will be required for production deployment but is not required for Phase I submissions. Vendors should be prepared to provide detailed SBOM documentation in subsequent phases.

82 What is the anticipated annual contract volume? Please refer to the answer provided for question 32.

83 Will the Government consider allowing a smaller font size, ≥9 pt, for graphics? No, the font size outlined in the call shall be followed, and smaller font sizes, such as ≥9 pt, will not be considered for graphics.

84 Does the Government have a deadline for the new solution to be operational? The Government has indicated a target deadline for the new solution to be deployed and operational by June 1, 2026 85 Does the Government have defined/documented business processes to support contract management? If yes, can they please be shared with offerers?

The Government has defined and documented business processes to support contract management; however, these processes will not be shared with offerors at this time.

86 Does the solution have to have a DOD ATO prior to submission? Or will the government provide an ATO if selected?

A completed DoD Authorization to Operate (ATO) is preferred but not required for submission. Vendors without an existing ATO should demonstrate their capability to achieve authorization. If selected, the Government will work with the vendor to facilitate the ATO