AOI SMDC Prototype OT AMD 01.pdf

Version 1.0 Page 1 of 7

Area of Interest (AOI) for Secure Mobile Device Communications (SMDC)

Prototype Other Transaction (OT)

*Any submissions that are received by the Agreements Officer after the suspense date/time listed above will be deemed late and not evaluated. It is the sole responsibility of the company to ensure that its submission is received in the inbox listed above before the deadline specified.

This AOI may result in the Government awarding a prototype OT in accordance with 10 U.S.C. § 4022. This AOI, and any OT awarded from this AOI, is not subject to the Federal Acquisition

Regulations (FAR) or its supplements.

Project Number DISA-OTA-26-R-SMDC

Commercial Solutions Opening Number

HC108425S0001

AOI Title Secure Mobile Device Communications Prototype OT

Issued By Defense Information Systems Agency (DISA) | www.disa.mil Defense Information Technology Contracting Office (DITCO)

Submission Instructions To respond to this AOI, please refer to paragraph 4 of the AOI and the Commercial Solutions Opening, section 3.1, General Guidelines and section 3.2, Phase 1 Solution Briefs.

*Solution Briefs Due Date/Time (Suspense)

22 April 2026, 5:00 p.m., CDT

Submit Solution Brief To

DITCO OTA Team:

disa.scott.ditco.mbx.ps84-other-transaction-authority@mail.mil Agreements Officer: Joe Santel Agreements Specialist: Ashley Fleming

Version 1.0 Page 2 of 7

1. BACKGROUND

DISA currently manages mobile device services for the Department of Defense (DoD) and approved non-DoD users and is required to maintain compliance with evolving Commercial Solutions for Classified (CSfC) standards. The continuous evolution of CSfC Mobile Access Capability Package (MACP) requirements is essential for meeting growing security demands while improving functionality, usability, and compliance in a rapidly changing technological landscape. Earlier mobility solutions consisted of an End User Device (EUD), such as a phone, tablet, or laptop, paired with a Retransmission Device (RD) that functioned as a commercial mobile hotspot.

2. PROBLEM STATEMENT

The latest published CSfC MACP (version 2.7) requires the RD to be connected to the mobile device through a hardwired connection. In earlier versions of MACP, this requirement could be met by using a cellular hotspot device that connects to the mobile device via Wi-Fi connection.

While a cable connection meets the new MACP technical standard, it is operationally untenable.

The use of a visible cable between the EUD and the RD creates two critical issues:

a. Degraded User Experience & Risk: Physical cables introduce significant user experience challenges and operational risks. From a user perspective, the cable is an encumbrance that can snag on other gear, get caught on the environment, and physically tether the user, restricting their mobility and creating a potential point of failure if disconnected. The physical cable makes the phone conspicuous and draws unwanted attention. This visibility creates a significant operational security risk. In environments where stealth and operational discretion are critical, such exposure could compromise the security of the mission and the individual, making it easier for adversaries to target or disrupt operations. The presence of a physical cable can serve as an indicator of the operator’s location, role, and equipment type, increasing the likelihood of detection and compromising the security of sensitive activities.

b. Reduced Tactical Mobility: Forcing users to carry and physically connect separate devices is cumbersome, creates a logistical burden, and hinders the tactical mobility required for accessing networks like the Secret Internet Protocol Router (SIPR) Network in operational environments.

This prototype OT seeks to develop an innovative and user-friendly Retransmission Device (RD) to bridge the gap between CSfC standards and operational needs. The ideal solution, likely a sleeve or integrated case, will satisfy the new CSfC hardwired connection requirement internally while appearing as a normal case to the outside observer. The goal is to eliminate conspicuous external cables, remove the logistical burden of separate devices, and restore full tactical mobility for users.

3. DESIRED SOLUTION ATTRIBUTES

A fully functional prototype must include the following unique or innovative capabilities, functions, and/or features:

Version 1.0 Page 3 of 7

3.1. Core Compliance & Physical Design

a. The solution must meet or exceed all requirements of the CSfC MACP version 2.7, and all subsequent versions released during the period of performance.

b. The solution’s physical footprint shall be minimized to reduce its visual signature. While a form factor similar in size to a commercial smartphone case is the desired baseline, companies are encouraged to propose innovative solutions that achieve the core requirement of being inconspicuous.

c. The solution must be an all-in-one form factor that eliminates the need for a separate device and connecting cable.

d. The solution must be modular to enable rapid, cost-effective portability of capabilities across current and future EUD form factors.

e. The solution or physical design (e.g., smartphone case) must support both current and future approved DoD mobile devices/form factors (e.g., Samsung Galaxy S25 or S26). The ability to support additional form factors (e.g., tablets, laptops, etc.) is a desired feature; however, support for additional form factors would only be required in a follow-on production OT or contract.

3.2. Component & Supply Chain Security

a. The solution must be compliant with CSfC and National Information Assurance Partnership

(NIAP) requirements. All components used in the solution must be on the CSfC Components List and NIAP validated. The Government will not consider solutions that rely on achieving NIAP validation during the prototype period of performance.

b. The solution must adhere to Supply Chain Risk Management principles throughout its lifecycle.

c. The solution must adhere to the Trade Agreements Act statutes throughout its lifecycle. All manufacturing and assembly, throughout the prototype and any potential follow-on production, must be performed domestically in compliance with International Traffic in Arms Regulations (ITAR).

d. All modem chips must be compliant throughout the period of performance with Section

889(a)(1)(A)&(B) of the FY19 National Defense Authorization Act (NDAA).

e. The Company must describe their process for adapting the proposed solution to new Government-approved moblie devices and form factors. In their solution brief, the Company must commit to completing any future form factor change requests within 90 days of receiving a formal request from the Government. This capability is considered a required performance standard for the successful awardee.

Version 1.0 Page 4 of 7

f. The company must demonstrate the ability to produce at scale and meet demand via an ITAR regulated facility.

3.3. Connectivity & Transport

a. The solution must provide unlocked, Fourth-Generation (4G)/Long-Term Evolution wireless network transport that can provide service in Continental United States (CONUS) and Outside Continental United States (OCONUS) for the prototype OT. If a follow-on production OT or contract is awarded, the Company must be capable of further developing the solution to support both 4G and Fifth-Generation cellular transport. “Unlocked" is defined as not being bound to a specific carrier, supporting both embedded Subscriber Identity Module (SIM) and physical SIM cards.

b. The proposed solution must have the ability to utilize CONUS cellular modems for the prototype. If a production OT is awarded, the solution must support both CONUS and OCONUS cellular connectivity.

c. The solution must provide 802.11 a/b/g/ac (Wi-Fi 6E/7) transport options.

d. The connectivity chip responsible for external communication must be physically distinct from the main processor and not integrated within the same chip.

e. It is desired, but not required, that the capability be designed to support emerging transport options, such as Direct-to-Device satellite communications, where applicable.

f. The prototype must demonstrate Wi-Fi connectivity only. If a follow-on production OT or contract is awarded, the Company must be capable of futher developing the solution to support both Wi-Fi and Cellular connectivity.

g. The Company must demonstrate the ability to obatin Federal Communications Commission

(FCC) Certification for any components requiring U.S. celleuar network access. Applicable FCC certifications would only be required for a follow-on production OT or contract.

3.4. Security Features

a. The ability to create an outer VPN on the RD is a desired feature. If the outer VPN capability is included, it must utilize a cryptographic key store that is physically and logically independent of the EUD.

b. If the RD is used to create a VPN, it must be able to support the CNSA Suite 2.0 Profile for

IPSEC in accordance with the draft CSfC Post Quantum Cryptography Guidance Addendum.

3.5. Lifecycle, Service & Management

Version 1.0 Page 5 of 7

a. The solution must include full lifecycle support, if the prototype is successful and moved into production, to include planning, procurement, deployment, sustainment, and secure disposal.

b. The solution must offer a framework to control lifecycle costs and provide comprehensive support. This framework must account for future hardware and software evolution, allowing for cost-effective scalability and ongoing upgrades throughout the lifecycle of the solution.The solution must support automated inventory and asset tracking.

c. The solution must be administered via a centralized, cloud-based platform that is authorized at Federal Risk and Authorization Management Program (FedRAMP) High and/or DISA Impact Level 6.

d. The platform must support secure, over-the-air firmware updates.

e. The platform must provide tools for remote monitoring and reporting.

4. AWARDING INSTRUMENT

This AOI solicitation will be awarded in accordance with the Commercial Solutions Opening (CSO) procedures detailed within the DISA CSO HC108425S0001, posted to SAM.gov on 8 January 2025. The CSO outlines the guidelines for submitting solution briefs, pitches, and proposals and how the Government will evaluate responses to this AOI. The CSO can be found at: https://sam.gov/opp/98c4a509d78f4f95ae21586d7004fd0e/view

As identified in paragraph 3.2 of the CSO, the Affirmation of Business Status Certification is attached to this AOI.

5. SOLICITATION NOTES

In addition to the general guidelines included in the CSO, the following guidelines apply to this

AOI.

The Government will give preference to submissions that demonstrate an existing, reference-verifiable commercial ability to accomplish the desired solution attributes listed above.

If the Government does not receive any solution briefs that demonstrate an innovative, existing, and reference-verifiable commercial ability to accomplish the desired solution attributes listed above, preference will be given to submissions demonstrating existing and recent products that can be adapted for the solicited purpose with the least amount of non-recurrent-engineering effort.

To align with the target schedule, proposals with a performance period of six months or less are ideal. This timeframe is preferred to ensure rapid development and deployment of the proposed solution, allowing for a timely transition from the prototype phase to full implementation if the prototype has been determined successful by the Government.

Version 1.0 Page 6 of 7

The anticipated total cost for this prototype project is between $500,000 to $850,000 to deliver 20 devices over a 6-month project period, including all associated costs for development, implementation, and necessary support.

The primary goal is to identify and select the best possible solution for the Government's needs.

As such, all submissions are strongly encouraged for consideration, regardless of the proposed performance period or target cost. The Government will evaluate each proposal based on its merits, innovation, feasibility, The following attributes are noted:

1. Cloud Environment & Accreditation An Authority to Operate (ATO) at FedRAMP High / IL6 is not a requirement at the time of prototype award. Offerors may utilize any appropriate cloud environment for initial development and testing, including commercial environments. The Government will work collaboratively with the awardee to achieve the necessary accreditations throughout the period of performance.

2. Device Operational State & Enclosure The retransmission device is expected to be operational whenever the paired smartphone is powered on. For the prototype phase, a ruggedized or IP-rated enclosure is considered a desirable feature but is not a firm requirement.

3. Performance Timeline The stated period of performance is six months. However, the Government will view proposals that include a significantly accelerated delivery schedule (e.g., 90-120 days) in a positive light.

This will be considered as part of the overall assessment of the submission.

4. NIAP Certification Requirements

The retransmission device itself is not required to have NIAP certification if its function is limited to providing hardware isolation.

If the proposed solution includes the capability for the retransmission device to create the outer VPN tunnel (i.e., a Dedicated Outer VPN per CSfC MACP), then this function must be performed by a VPN client that has existing NIAP approval under PP- Module for VPN Client, Version 2.4 or 2.5. Proposers should not expect to achieve NIAP validation for a new component during the performance period.

6. CERTIFICATION REQUIRED

In accordance with 32 CFR part 170, the Cybersecurity Maturity Model Certification (CMMC) Program applies to this prototype project. CMMC Level 2 (Self) is required for this prototype project. CMMC Level 3 (C3PAO) will be required in a follow-on production OT or contract, to be implemented on or about 10 November 2027. Companies are required to have CMMC Level 2 (Self) prior to the award of a prototype OT for each company information system that will

Version 1.0 Page 7 of 7 process, store, or transmit Federal contract information (FCI) or controlled unclassified information (CUI) during performance of the prototype OT.

A company will not be eligible for the award of a prototype OT if the company does not have their current CMMC status entered in the Supplier Performance Risk System (SPRS) (https://piee.eb.mil) at the CMMC level 2 (self) and a current affirmation of continuous compliance with the security requirements identified at 32 CFR part 170 in SPRS.

Companies are responsible for all costs and actions necessary to achieve and maintain CMMC compliance.

7. FOLLOW-ON PRODUCTION

Companies are advised that any prototype OT agreement awarded in response to this AOI may result in the award of a follow-on production contract or transaction without the use of further competitive procedures. The follow-on production contract or transaction will be available for use by one or more organizations in the Department of Defense and, as a result, the magnitude of the follow-on production contract or agreement could be significantly larger than that of the prototype OT. As such, any prototype OT will include the following statement relative to the potential for follow-on production: "In accordance with 10 U.S.C. § 4022(f), and upon a determination that the prototype project for this transaction has been successfully completed, this competitively awarded prototype OT may result in the award of a follow-on production contract or transaction without the use of competitive procedures.”