Attachment 1 - Call for Solutions - SUNet Modernization - DOWCDAO-ARL-26-01 (Amendment 003).pdf

Amendment 0003: The purpose of this amended CSO call is to adjust the deadline for Solution Brief submissions to Thursday, 05 March 2026 @ 1200 ET, and add clarifying technical details as highlighted in yellow within the document.

This Call for Solutions solicitation is associated with the Army's Open Solicitation, W9128Z-25-S-A002.

Please see the referenced link for more information.

Link: https://sam.gov/opp/e486c3a09b594cba8c1e1b06d23aef4a/view

Note 1: Please advise the cognizant Contracts/Agreements Officer and Specialist as soon as possible via the email above if your organization intends to submit a Solution Brief in response to this Call for

Solution.

Note 2: ARL and CDAO hosted a Question and Answer (Q&A) session virtually on 12 February

2026. No additional questions are permitted after the virtual Q&A session. Interested vendors may receive a summary of the virtual Q&A session (including responses to questions discussed), after the

Government has validated their SECRET facility clearance and prior to the Solution Brief submission deadline. Before receiving the Q&A summary, vendors must submit their company name and CAGE code to usarmy.adelphi.devcom-arl.list.nextgen-sunet@army.mil for clearance verification..

Project Number Call for Solution – DOWCDAO-ARL-26-01

Open Solicitation Number W9128Z-25-S-A002

Mission Partner Office of the Undersecretary of War for Research and Engineering (OUSW(R&E)) Chief Digital and AI Office (CDAO), in collaboration with the

U.S. Army Research Laboratory (ARL)

Call for Solution Title Secure Unclassified Network (SUNet)

Modernization

Issued By Army Contracting Command (ACC), Aberdeen

Proving Ground (APG) Adelphi

Submission Instructions To respond to this Call for Solution, please refer to Sections 6 of this Call for Solution

SUNet modernization questions/clearance submission deadline

Tuesday, 10 February 2026 at 1400 ET (See Note

2 below)

SUNet modernization Q&A On or about Thursday, 12 February 2026 (See

Note 2 below)

Solution Briefs Due Date/Time (Suspense) Thursday, 5 March 2026 at 1200ET

Submit Solution Brief To Agreements Officer:

Ariel.m.amey.civ@army.mil

Specialist: william.p.korzeniewski.civ@army.mil https://sam.gov/opp/e486c3a09b594cba8c1e1b06d23aef4a/view mailto:usarmy.adelphi.devcom-arl.list.nextgen-sunet@army.mil submissions to Thursday, 05 March 2026 @ 1200 ET, and add clarifying technical details as highlighted

Secure Unclassified Network (SUNet) Modernization

1.0 Problem Statement

The Department of War (DoW) requires the next generation of its Secure Unclassified Network

(SUNet) system. SUNet is government owned, secure, unclassified digital infrastructure that enables DoW and mission partners to rapidly experiment with new software and develop

Artificial Intelligence and Machine Learning (AI/ML) tools off the Department of Defense

Information Network (DoDIN)-- without sacrificing cybersecurity. SUNet acts as a digital sandbox and provides logically segmented areas of compute and storage resources for DoW and mission partners to collaborate, label data, rapidly onboard, experiment with, develop, and validate emerging AI/ML tools. CDAO is seeking innovative and modernized approaches to the challenge areas listed below. The overall objective is to iteratively develop and demonstrate a next generation SUNet that is optimized for rapid experimentation, development, testing, and validation of AI/ML tools, as well as data labeling, off the DoDIN. See specific requirements in sections 3.0. The government’s intent is to award a separate follow-on production contract(s) or transaction(s) (reference section 10.0 below) for a valid prototype. The follow-on contract or transaction will be available for use by one or more organizations in the DoW, and as a result, the magnitude of the follow-on production contract or agreement could be significantly larger than that of the prototype OT.

2.0 Background:

SUNet provides logically segmented areas of compute and storage resources for DoW and mission partners to collaborate, label data, rapidly onboard, experiment with, develop, and validate emerging AI/ML tools. The legacy SUNet system was born out of the need for warfighters to securely collaborate and share information and data with foreign partners, without a Common Access Card (CAC), during the Global War on Terror. The legacy system was primarily architected in 2015. Based on state of technology at the time, SUNet infrastructure is currently centered around legacy hardware in a data center. As of 2025, SUNet Enclaves, logically segmented collection of compute and storage resources within an accreditation boundary, are in a hybrid environment in this data center alongside AWS and Azure cloud service providers (CSP).

The evolution of AI/ML technology over the last decade has fundamentally changed the operating environment and war fighting for the DoW. Consistent with this reality, SUNet’s mission and architecture evolved to fill a critical gap in the Department—the ability to collaborate and rapidly experiment in a secure digital sandbox Impact Level 5 (IL5) environment with non-traditional partners on AI/ML workloads, without a CAC, in a government-owned environment. SUNet is accredited by an Authorizing Official (AO) to host Controlled submissions to Thursday, 05 March 2026 @ 1200 ET, and add clarifying technical details as highlighted

Unclassified Information (CUI) data. It is the only accredited off-DODIN infrastructure of its kind.

3.0 Desired Solution Objectives

CDAO is seeking innovative and modernized approaches to the challenge areas listed above. The overall objective is to iteratively develop and demonstrate a next generation SUNet that is optimized for rapid experimentation, development, testing, and validation of AI/ML tools, as well as data labeling, off the DoDIN. Specific requirements for the prototype include:

3.1 Demonstrate ability to rapidly onboard a diverse range of customers including DoW, academia, industry, commercial, foreign partners, federally funded research and development centers, and other USG entities.

3.2 Demonstrate ability to establish at least seven (7) types of segmented virtual enclaves

(logically segmented collection of compute and storage resources within an accreditation boundary) with specific characteristics to provision to customers for development and operational activities:

Enclave One infrastructure that includes the following characteristics:

1. Demonstrate ability to implement hybrid on-premises and cloud infrastructure, with on-prem infrastructure available for testing of specific processors’ ability to support

AI tool testing with cloud backup for data and models.

2. Ability to host and/or connect to a comprehensive and searchable data catalog to facilitate intuitive data discovery and access for all users and implement functionality for users to upload and manage data sheets and “DataCards” ensuring data integrity and the association of proper metadata.

3. Ability to host diverse user group including government users and traditional DoW vendors with CACs as well as academia and non-traditional industry users without

CACs requiring alternative Multi-factor authentication (MFA) implementations.

4. Ability to host software development and testing capabilities focused on AI/ML models with custom service-owned data sets.

5. Ability to support multiple simultaneous projects with different vendors, necessitating strict access controls to limit exposure of vendor proprietary information (e.g., code) to other vendors while operating in the same Enclave.

ii. Enclave Two infrastructure that includes the following characteristics:

1. Ability to provide a secured IL5 environment for a wide variety of vendor and/or government provided tools to be used for data labeling of full motion video data to develop AI/ML algorithms.

2. Ability to monitor and restrict download capability by individual user.

iii. Enclave Three infrastructure that includes the following characteristics:

submissions to Thursday, 05 March 2026 @ 1200 ET, and add clarifying technical details as highlighted

1. Ability to securely enable tenants with IL5 data to connect to the internet while restricting internet access to other tenants as required.

2. Ability to develop and test software in a pre-production environment.

3. Ability to implement a production environment for deployment of developed software and integration with multiple external partners (external to SUNet) for incoming and outgoing data products.

iv. Enclave Four infrastructure that includes the following characteristics:

1. Ability to interact with edge systems that have intermittent connectivity to CSP platforms.

2. Ability to support non-standard hardware to enable mission-specific communication capabilities.

3. Ability to move AI models and data via cross domain solution.

v. Enclave Five infrastructure that includes the following characteristics:

1. Ability to communicate to and from remote sites securely via virtual private network (VPN)

2. Ability to support non-standard communication protocols to transfer data to/from edge environments.

vi. Enclave Six infrastructure that includes the following characteristics:

1. Ability to have managed attribution to support anonymous data collection across the open Internet.

vii. Enclave Seven infrastructure for Secure Development/Testing Environment that includes the following characteristics:

1. Ability to support secure use of non-standard tools and software that are required for development of specialized products but may not be able to be fully hardened

(e.g., have dependencies on vulnerable components) including use of CUI data.

2. Ability to support secure testing of software and products with CUI data prior to hardening to determine if they are worth Government investment.

3.3 Demonstrate infrastructure with ability to deploy mission-specific data and tools in different enclaves to fulfill mission-specific requirements. This includes:

o Tools to enable tenants to meet January 2026 DoW Data Catalog requirements and other DoW data requirements;

o Tools to facilitate reasonable, timely, and secured user onboarding;

o Tools to conduct model and container integration (i.e. GitLab) to include built in scanning capabilities to ensure the integrity of all imported assets;

o Secure data ingest pipelines featuring a built-in sequestration capability to isolate and manage data according to specified security and access control pieces;

submissions to Thursday, 05 March 2026 @ 1200 ET, and add clarifying technical details as highlighted o Provide comprehensive support for data movement, including secure transfers to and from Amazon Web Services (AWS), on premise data stores, and external third-party data stores, as well as the logistical management of physical hard drive shipments for larger data sets.

o Enable sensor "reach back" and facilitate reliable data transfer utilizing Short

Burst Data (SBD) and any other applicable communication protocols.

3.4 Demonstrate ability to deploy enterprise tools and data management capabilities that are accessible to different enclaves to fulfill common requirements. This includes:

o Downloading software libraries o Tools to manage data ingest, tracking, and cataloguing;

o Tools to support system updating, patching, and maintenance without requiring enclaves to directly access the Internet (e.g., vendor patch repositories, community DevSecOps pipelines, and related capabilities);

o Tools to track file ingress and egress, including Data Loss Prevention capabilities;

o Robust Security Information and Event Management (SIEM) solution for enterprise level log and event management, and Security Operations Center

(SOC) capabilities;

o Cybersecurity tools and support services, including vulnerability and configuration scanning, report distribution, Plan of Action and Milestones

(POA&M) management, Enterprise Mission Assurance Support Services

(eMASS) record management, and related functions, in accordance with DoW and CDAO guidance, policies and procedures, and to enable mission partners to maintain compliance with cybersecurity requirements;

3.5 Demonstrate a hybrid system design with both on premise and multi-cloud infrastructure.

3.6 Demonstrate ability to configure GPU/CPU resources.

3.7 Demonstrate ability to meet Zero Trust Architecture and National Institute of Standards and Technology Special Publication (NIST SP) 800-53 Rev 5 requirements.

o The automated, robust auditing system for user access to data must monitor and validate that individual access to datasets aligns with the specific distribution statements and controls of said data.

3.8 Demonstrate ability to implement automation to minimize down time, reduce risk of mistakes (human error), and meet cybersecurity requirements of the platform’s Authority To

Operate (ATO). For example, implement infrastructure as code (IAC), to include automating the creation, modification, and management of SUNet infrastructure resources and services in accordance with modern DevSecOps software lifecycle best practices, DoW guidance, and

CDAO guidance.

submissions to Thursday, 05 March 2026 @ 1200 ET, and add clarifying technical details as highlighted

3.9 Demonstrate ability to support remote access by users (including administrators) to their respective environments securely, minimizing risks for data leaks, introduction of malicious code, and similar issues in a Bring Your Own Device (BYOD) environment. Users should not be required to be at an onsite location in order to access SUNet for most functions

(emergency functions excepted and limited to enterprise engineers/system admins).

3.10 Demonstrate ability to maximize automation of DevSecOps practices to improve the software baseline management and integrity across all environments (e.g. development, test, training, and production), and limit manual processes for deployment of resources. Real time scanning of containers in use and managing patching/updating should also be supported.

3.11 Demonstrate system ability to become authorized to host CUI data at IL5.

3.12 Demonstrate modular and scalable infrastructure that maximizes flexibility and avoids vendor-lock.

3.13 Demonstrate ability to maximize monitoring capabilities to improve security.

3.14 Demonstrate ability to maximize fully-managed cloud native services.

3.15 Demonstrate ability to implement Identity, Credential, and Access Management

(ICAM), to include authentication, authorization, and auditing capabilities, to ensure secure access to DoW resources that meet DoW CIO’s FY2027 Zero Trust target levels. At a minimum, must require multi-factor authentication for both CAC and non-CAC holders.

3.16 Demonstrate ability to integrate with data governance and management software.

3.17 Demonstrate ability to implement a clear and simple charge back model for SUNet customers.

3.18 Demonstrate ability to implement operations processes and knowledge management practices to enable the core SUNet infrastructure team (currently CDAO) to operate separately from the individual SUNet Enclave teams (customers across DoW) for purposes of management and funding decisions.

3.19 Demonstrated expertise in code management solutions (e.g. GitLab) for advanced version control, Continuous Integration and Continuous Delivery (CI/CD) pipeline management, and repository administration.

3.20 Demonstrated experience with multiple major cloud platforms, including deep knowledge of Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) solutions.

3.21 Demonstrated proficiency in operating systems and networking.

submissions to Thursday, 05 March 2026 @ 1200 ET, and add clarifying technical details as highlighted

3.22 Demonstrated understanding and practical application of Security Technical

Implementation Guides (STIGs and SRGs, as well as vendor hardening guides for less common technologies), CSP security checklists/benchmarks, and expertise in utilization of common tools for system hardening and security compliance, POA&M management, eMASS record management, cybersecurity reporting, and related functions.

3.23 Demonstrated experience in architecting solutions for managing and analyzing large-scale datasets, including expertise in modern big data technologies and frameworks.

3.24 Demonstrated experience in Information System Security Officer (ISSO) and

Information System Security Manager (ISSM) roles, with expertise operating within government security and compliance frameworks.

4.0 Project Expectations

1. The SUNet prototype must include all enclave types/characteristics outlined in Section

3.2.

2. The prototype should be refined and proven enough to be considered a minimum viable product (MVP) no later than 6 months from contract award/start.

2.1 MVP is achieved when each enclave demonstrates ability to support each characteristic and/or capability outlined in Section 3.2.

2.2 For the on-premise requirements, the government will accept a variety of ways to demonstrate these requirements including demonstrations utilizing contractor-owned infrastructure and/or notional designs.

3. The government’s intent is to award a separate follow-on production contract(s) or transaction(s) (reference section 10.0 below) for a valid prototype. Companies should include a projected milestone schedule for how they will develop the minimum viable product (end result of the prototype) into a full production system no later than 6 months from a follow-on contract award/start.

5.0 Awarding Instrument

This Call for Solution solicitation will be awarded in accordance with the Army Open

Solicitation (AOS) procedures detailed within Solicitation W9128Z-25-S-A002.

6.0 Submission Instructions

6.1 Submission Overview: Companies responding to this call shall submit a Solution Brief for evaluation. Submissions are to be sent via email only to the Agreements Officer and Specialist

(POCs) listed in this Call for Solutions. We are interested in unique and innovative approaches, including techniques to reduce costs, improve efficiency, and enhance performance. The

Government may utilize up to three (3) phases for assessing solutions:

submissions to Thursday, 05 March 2026 @ 1200 ET, and add clarifying technical details as highlighted

1. Solution Brief – a white paper including a technical discussion explicitly addressing the target problem statement and how the proposed solution meets the Objectives and evaluation criteria. Solution Brief format and instructions are in Section 6.2 below.

2. Live Pitch (unless bypassed) – an oral briefing/demonstration with a technical challenge with instructions provided following phase 1.

3. Solution Proposal – a written technical approach, statement of work, and pricing proposal in response to a request for solution proposal.

6.2 Solution Brief Format and Instructions: Solution Briefs shall conform to the following, and in the following order. Each Solution Brief shall not exceed seven (7) written pages (not including the title page, company information, or table of contents) using a font that is readable without magnification. Use of diagram(s) or graphics with associated bullet points and text layout to depict the essence of the proposed solution is strongly encouraged. Should offerors submit anything longer, the Government will only evaluate the first seven (7) pages of a Solution

Brief.

• Title Page: Company information shall include the following:

Name of Company

Business Size

Company’s Commercial and Government Entity (CAGE) number

Unique Entity Identifier (UEI) number

Contracting Point of Contact (POC) [Name, Phone, Email]

Technical POC [Name, Phone, Email]

• No more than three (3) pages including three (3) gate criteria:

✓ Gate criteria 1: verifiable documentation that the vendor holds a SECRET facility clearance and is TS SCI eligible;

▪ SECRET Facility Clearance (FCL): To satisfy this requirement, vendors shall provide their company name and CAGE code for the purpose of the

Government verifying the vendor's clearance within the National Industrial

Security System (NISS). For vendors with active security clearances not accessible in NISS, alternative documentation shall be provided as applicable.

▪ TS/SCI Eligibility: To satisfy this requirement, companies may include a formal self-certification statement in the solution brief, affirming that the company meets all requirements to be eligible for a TS facility clearance, and can provide TS/SCI-eligible individual(s) during the performance of the full production system.

✓ Gate criteria 2: a projected milestone schedule showing the proposed prototype solution can be refined and proven enough to be considered a minimum viable submissions to Thursday, 05 March 2026 @ 1200 ET, and add clarifying technical details as highlighted product no later than 6 months from contract award/start; AND a projected milestone schedule for how the prototype is able to be refined into a full production system within 6 months following prototype completion; and

✓ Gate Criteria 3: Between one (1) and three (3) references demonstrating experience with similar projects or programs with at least one (1) referencing experiences with the federal government.

• Four (4) pages of technical discussion explicitly addressing the target problem statement and how the proposed solution meets the evaluation criteria.

These four (4) pages shall include a plan to demonstrate a proposed SUNet prototype that meets the Project Expectations referenced in 4.0 and the objectives in 3.0. The proposed solution must demonstrate the ability to fulfill all desired objectives and enclave characteristics in their entirety. Each submission should include details on existing certifications for technical components of their plan.

• One (1) page Rough Order of Magnitude (ROM), which includes sections for both the initial demonstration (prototype phase) AND the estimated out-the-door total price to implement the proposed solution for 20,000 annual users for three (3) years (follow-on production phase).

o Within the ROM for the follow-on production phase, please make clear the projected pricing for any “up front” elements associated with the initial build and set-up, versus the ongoing operation and maintenance of the system.

Rough Order of Magnitude:

Proposer solution brief must provide a ROM estimate clearly communicating the pricing for each desired solution feature in section 3 above. Sample format:

Desired Solution Features

(reference section 3.0)

Estimate

Section # or #s (3.X…) $

[Add more rows as needed] $

TOTAL $

7.0 Evaluation Process and Criteria

submissions to Thursday, 05 March 2026 @ 1200 ET, and add clarifying technical details as highlighted

The Government will conduct evaluations and make award selections in accordance with the technical, merit-based CSO authority. Solution Briefs submitted against this Call for Solutions will be vetted against gate criteria prior to evaluation. Submissions must minimally meet the gate criteria outlined in section 6.2.

The Government will do an initial evaluation of the solution brief and if it is determined that the submissions do not meet the gate criteria, it will be deemed “not selectable” and will not be further evaluated. Submissions meeting the gate criteria will be assessed in accordance with the evaluation criteria cited below and scoring rubric in Table 1 and rated as either “selectable” or “not selectable” for Phase I. Contractor support may be utilized to support proposal evaluation in a non-decision making capacity. If the

Government determines contractor support will be utilized, any contractor personnel involved in the evaluation will be required to sign non-disclosure agreements. By submitting a Solution Brief, you authorize the white paper to be distributed and used for this purpose. During the assessment period, the Government and/or supporting Subject

Matter Experts (SMEs)/advisors may contact submitting entities to clarify submitted information.

The Government will inform Companies whether they have or have not been selected to move forward to the next phase. Those Companies whose Solution Briefs are deemed

"selectable" will be invited to submit a more comprehensive Pitch and/or Proposal. At that time a due date and time for the following phase will be communicated.

After pitches, the Government may further down-select potential awardees and issue a request for solution proposal (“RSP”) to the remaining candidate company (or companies). The RSP will have specific guidelines for submission and evaluation.

Solution Briefs and pitches will be evaluated based on the following evaluation criteria:

a. Feasibility – solution is technically possible. This criterion measures whether the technology exists or is likely to be developed in the scope of this prototype effort.

b. Viability – solution is compatible with DoW constraints, technical environments and other organizational requirements. This criterion measures whether DoW could easily adopt the prototype.

c. Desirability – solution is responsive to the problem statement and desired solution objectives. This criterion measures whether end users are likely to adopt the offeror’s prototype solution. An example of something which is not desirable is a software (SW) solution that is not intuitive/easy to use and requires extensive training for use/operations.

submissions to Thursday, 05 March 2026 @ 1200 ET, and add clarifying technical details as highlighted

d. Technical Merit: The Government will evaluate the Offeror’s proposed solution/concept relevance to the respective Topic; innovation or a potential capability; solves a capability/gap/problem or provides potential innovative technological advancements;

e. capabilities and scalability of the solution; benefits of the solution/concept; and technical approach.

f. Schedule. The Government will evaluate the proposed solution/concept project schedule and maturity path.

g. Price. The Government will evaluate the reasonableness and affordability of the proposed rough order of magnitude (ROM), to include the estimated out-the-door total cost/price.

Definition

Does Not Provide Sufficient

Information to Evaluate

The solution brief lacks enough detail or clarity to determine compliance with requirements. Key elements are missing, incomplete, or ambiguous.

Fails to Meet Minimum

Requirements

The solution brief can be evaluated but does not satisfy one or more of the basic, mandatory requirements. It is not acceptable in its current form.

Meets Minimum Requirements The solution brief fully meets all required criteria but does so only at a basic level.

Meets Requirements and

Exceeds Some

The solution brief meets all requirements and includes enhancements or added value in one or more areas.

Far Exceeds Requirements The solution brief greatly surpasses all requirements. It offers exceptional quality, innovation, or value with clear, substantial benefits.

8.0 Intellectual Property (IP)

8.1 The Government will have unlimited rights to plans and system designs related to this project.

8.2 The Government unlimited rights to use, modify, and distribute the technical solutions for government purposes, including procurement and sustained activities.

9.0 Foreign Ownership and Control; Foreign Access to Technology submissions to Thursday, 05 March 2026 @ 1200 ET, and add clarifying technical details as highlighted

9.1 The Responder shall provide details of any foreign ownership or control that may exist within their corporate structure.

9.2 The Responder shall have the ability to create and store export-controlled data in accordance with export control regulations.

10.0 Follow-On Production

Companies should be advised that any prototype Other Transaction (OT) agreement awarded in response to this Call for Solutions may result in the award of a follow-on production contract or transaction without the use of further competitive procedures. The follow-on production contract or transaction will be available for use by one or more organizations in the DoW, and as a result, the magnitude of the follow-on production contract or agreement could be significantly larger than that of the prototype OT. CDAO requests a production Rough Order of Magnitude (ROM).

As such, any prototype OT will include the following statement relative to the potential for follow-on production: "In accordance with 10 U.S.C. 4022(f), and upon a determination that the prototype project for this transaction has been successfully completed, this competitively awarded prototype OT may result in the award of a follow-on production contract or transaction without the use of competitive procedures.

11.0 Notes

• Offerors are responsible for monitoring SAM.gov for any amendments to this solicitation that may have updated information.

• The Government will give preference to submissions that demonstrate an innovative, existing, and reference-verifiable commercial ability to accomplish the desired solution attributes listed above.

• Resellers and academic research proposals are not desired.

• Contractors with appropriate non-disclosure agreements and non-competes may serve as advisors to the source selection panel.

• All solution briefs will be valid for 180 calendar days after the submission date.

• The Solution Brief must identify any intellectual property involved in the effort and associated restrictions on the Government’s use of that intellectual property.

• The Government reserves the right to go directly from Solution Brief to award.

submissions to Thursday, 05 March 2026 @ 1200 ET, and add clarifying technical details as highlighted

• The Government reserves the right to award more than one (1) award resulting from this Call for Solutions or to make no award.

• Submission of proposal does NOT guarantee award.

• Completion of prototype does NOT guarantee follow-on production contract.

12.0. General Information/Questions

General inquiries related to this Call for Solutions may be directed to the Agreements Officer and

Specialist (POCs) listed in this Call for Solutions.