Innovation Call 01 - QA Live Session Presentation.pdf

LIVE QUESTIONS AND ANSWER (Q&A)

SESSION

Agreements Officer: Daniela Garavito Agreements Specialist: Salima McCravey 9/16/2026

DCSA INNOVATION GATEWAY

INNOVATION CALL #01

UNIFIED APPLICATION ACCESS AND

INTEGRATION PROTOTYPE

DEFENSE

COUNTERINTELLIGENCE

AND SECURITY AGENCY

Purpose & Agenda

A G E N DA

Disclaimer

Q&A

P U R P O S E Address pre-submitted vendor questions

D C S A P a r t i c i p a n t s

• Mr. Daniel Blalock, SES Acquisition & Technology, Portfolio Acquisition Executive

(PAE)

• Ms. Rebecca Cellarius, SES Acquisition & Technology, Portfolio Acquisition Executive

(PAE)

AND SECURITY AGENCY

The Government will utilize this live session to:

• Address the majority of the pre-submitted questions and cannot guarantee responses to newly introduced questions during the event.

• In the event of any discrepancy between the information provided verbally or in writing during the information session, the written terms and conditions of the Innovation Call #01 and DCSA Innovation Gateway General Solicitation HS0021-26-CSO-DCSA shall prevail.

Live Q&A Disclaimer

TECHNICAL QUESTIONS

AND SECURITY AGENCY

Applications:

• Investigation Management (IM) supports the case initiation process, phased out in FY 27 Q1 / Q2

• Deployed in DCSA AWS GovCloud IL5

• Pega workflow platform with PostgreSQL

• Interfaces / API – eApp, eQIP, Mirador (MuleSoft)

• D-MFA (Okta IDaaS FedRAMP)

• Electronic Application (eApp) allows subjects to complete security forms (e.g., SF85 / SF86 / PVQ), Industrial Security forms (e.g., DD254) in future additional forms

• Deployed in DCSA AWS GovCloud IL4

• Custom Go application deployed Docker containers with PostgreSQL

• Interfaces / API – IM, USPS (MuleSoft)

• D-MFA (Okta IDaaS FedRAMP), future will move to DISA E-ICAM

• Position Designation Tool (PDT) provides federal agencies assess the duties and responsibilities of federal positions to determine their appropriate sensitivity and risk levels.

• Deployed in DCSA AWS GovCloud IL4

• Custom Java application deployed in Docker containers, currently no database, future will have PostgreSQL

• Currently no interfaces, future will have interfaces with eApp and case initiation

• Currently no ICAM, future will move to DISA E-ICAM

• Individual Engagement Portal (IEP) allows subjects to see status of investigation and self report

• Deployed in DCSA AWS GovCloud Il4

• Custom Java application deployed in Amazon Elastic Container Service with PostgreSQL

• D-MFA (Okta IDaaS FedRAMP), future will move to DISA E-ICAM

Q1: Please Confirm the Authoritative Scope Boundary

AND SECURITY AGENCY

Mission workflow

• Users: Government affiliated and non-affiliated users (e.g., subjects of investigations, covered Government and Contractors, industrial security professionals including in the future foreign nations)

• Identity and Access Management: Support multiple identify service providers to support multiple uses cases including identity proofing, authentication scenarios (e.g., CAC/PIC, External Certificate Authority, and non-PKI multi-factor), role and attribute-based authorization, and auditing

• Experience: Landing page that presents the user business services or functions they are authorized to performed based on their role(s) and attributes:

• Environment: Initial prototype will focus on IEP, eApp, and PDT experience, DCSA AWS GovCloud IL4, to demonstrate that the capability can be expanded to additional functions and services in the IL5 environment (e.g, Adjudication services, Initial Vetting services, Industrial Security)

Q2: What mission workflows and minimum user experience must the prototype demonstrate?

AND SECURITY AGENCY

Artifacts:

• Business Architecture: business process diagrams, capability views, operational activity views

• Data Architecture: data models, data dictionaries, data schemas, data flows

• Application Architecture: Hardware / Software List, BOM, software repositories, software documentation, concept of operations, security documentation (e.g., accreditation material)

• Infrastructure Architecture: network and application deployment diagrams, interface ports, protocols, and services

Resources:

• Management resources: Atlassian JIRA and Confluence, and ServiceNow

• Technical resources: AWS GovCloud DevSecOps (e.g.,GitLab and Artifactory), AWS Workspaces with developers tools (i.e., IDE(s), database tools, test tools)

• Common Services (e.g, ImageBuilder)

Q3. What technical artifacts and access will be available to the selected performer, and when?

AND SECURITY AGENCY

Identity and Access Management

• Support multiple identify service providers to support multiple uses cases including identity proofing, authentication scenarios (e.g., CAC/PIC, External Certificate Authority, and non- PKI multi-factor), role and attribute-based authorization, and auditing

• Current: DCSA uses a combination of internal solutions D-MFA (Okta IDaaS FedRAMP) and DISA E-ICAM (Microsoft Entra ID)

• Future: DCSA will continue to DISA E-ICAM (Microsoft Entra ID) and add DMDC MyAuth (Okta IDaaS FedRAMP), and other providers (e.g., Login.gov)

Q4. What identity, access-control, and user-context capabilities must the prototype support?

AND SECURITY AGENCY

Cloud Architecture / Environments

• DCSA AWS GovCloud IL5 environment, today in West Region, expansion to East Region underway

• DCSA has own VDSS

• Virtual Gateway (VGW) established direct DISA Boundary Cloud Access Point (BCAP)

• Follow AWS Well Architected Framework and AWS best practices

• Systems normally have separate development, test / integration, pre-production, and production environments (separate AWS accounts)

• Systems will support enterprise security monitoring (e.g., agents)

Q5. Please clarify the hosting and deployment model across IL4 and

IL5

AND SECURITY AGENCY

Security Authorization

• Follow the DoW RMF process, for prototype leverage software fast track

(minimum number of security control and security artifacts (e.g., deployment diagram, PPSM, CONOPS)

• Accreditation is required to process production data (i.e., PII data)

• Systems including prototypes are deployed in DCSA AWS GovCloud IL4 and/or IL5

• Systems including prototypes must have ICAM solution required to process production data

• DCSA AWS GovCloud DevSecOps (GitLab and Artifactory)

Q6. What security authorization approach applies to the prototype?

AND SECURITY AGENCY

Workloads Operations

- Support tickets (prior 6 months)

- eApp 94,297 tickets (roughly 6.5% of tickets were non-login related, that could have been elevated to Tier 3, most of those tickets were form related issues)

- NBIS IM – 5,544

- PDT – 1

Sustainment Development

- Basic application enhancements

- Tier 3 support and bug support for application

- Patching and security support for application

Q7. What sustainment workload and transition support should offerors use for planning?

AND SECURITY AGENCY

Enterprise Services:

Managed Service Provider (MSP):

• MSP contractor provides support to cloud engineering, cyber security, and DSO support

• MSP manages all cloud infrastructure and product environments

DevSecOps:

• DevSecOps capability with GitLab and Artifactory

Enterprise Data Layer

• Databricks is currently being implemented as Enterprise Data Layer

Data Analytics & Business Intelligence

• Qlik Sense is primary platform, will maintain Tableau and other tools

Other Enterprise Technologies

• Walkme digital adoption platform

• Tricentis test automation platform

• MuleSoft as standard for API implementation

• Kafka as event bus to support event-driven architecture

• Kogito business rules engine

Q8. What enterprise services are mandatory, available, or merely notional?

AND SECURITY AGENCY

• Question: Does the active Top Secret FCL requirement apply to the prime/Performer only, or also to subcontractors and significant technology participants?

• Answer: The prime must hold an active TS FCL. All other companies performing on this effort must hold, at minimum, a Secret FCL depending on the assigned work.

• Question: May a non-cleared subcontractor perform unclassified work under a cleared prime?

• Answer: No. An uncleared company may not perform on this effort.

• Question: How will DCSA verify FCL status?

• Answer: DCSA will verify FCL status through NISS using the offeror’s company name and CAGE Code.

• Question: May subcontractor personnel perform under the prime’s FCL if they meet the required personnel-clearance criteria?

• Answer: No

• Question: Which subcontractor personnel must hold interim Secret eligibility?

• Answer: All personnel assigned to perform under the effort must be U.S.

citizens and possess, at minimum, an interim Secret eligibility determination before performing work.

• Personnel requiring privileged access may require additional eligibility before receiving that access.

Security Questions

AND SECURITY AGENCY

• Question: How should nontraditional-defense-contractor participation be demonstrated; and may teams be refined between concept-paper and full-proposal stages?

• Answer:

• See DCSA Innovation Gateway Section 3 on eligibility requirements.

• Offerors must identify all proposed prime and subcontractor team members in the Solution Concept Paper and complete the OTA Eligibility Certification.

• DCSA will validate facility-clearance status through NISS using the offeror’s company name and CAGE Code.

• Because of the planned October award and performance start, offerors should treat the proposed team as final at Solution Concept Paper submission.

OTA Eligibility

AND SECURITY AGENCY

Per DCSA Innovation Gateway Section 4.1.3, Solution Concept Papers will be evaluated on:

(1) Concept Viability: Is the idea innovative, technically sound, and compelling? Are the proposed data rights and licensing viable for long-term integration?

(2) Mission Alignment: Does the vendor deeply understand the problem and its operational impact?

(3) Affordability: Is the ROM cost within an acceptable range for a prototype effort?

Solution Concept papers will be evaluated on the basis of their own merit of the proposed concept in addressing the Innovation Call and the factors above, not against other Solution Concept Papers submitted in response to the same Innovation Call.

DCSA will notify vendors of their Solution Concept Paper evaluation results (e.g.

Phase 2, if applicable). Please note that debriefs or feedback regarding Phase 1 submissions will not be provided.

Solution Concept Paper Evaluation

AND SECURITY AGENCY

ROM Content

Solution Concept Paper Template Instructions: Vendors shall provide a high-level cost estimate for a potential prototype project, broken down into major phases if applicable (i.e. project phase / estimated duration / estimated cost range).

ROM should cover

• the six-month prototype effort

• That should include the costs necessary to perform the proposed approach, including sustainment and any performer-provided commercial platform, subscription, hosting, license, or other non-Government-furnished dependency.

• Offerors may state explicit assumptions, exclusions, dependencies, and risk drivers.

• A detailed Statement of Work, milestones, deliverables, and fair-and-reasonable price will be developed during collaborative negotiation with selected vendor(s).

ROM Content

KEY DATES & SUBMISSION

AND SECURITY AGENCY

KEY DATES

• Solution Concept Paper Due Date:

09/18/2026 @ 9:00am ET

• Estimated Period of Performance Start:

10/15/2026

SOLUTION CONCEPT PAPER SUBMISSIONS

• Please send all submissions via email to the following POCs:

Agreements Officer (AO): Daniela Garavito, daniela.garavito2.civ@mail.mil Agreements Specialist (AS): Salima McCravey, salima.a.mccravey.civ@mail.mil

Key Date and Submission Reminders