ERP_CS_RFI_Quest_Resp.xlsx
XLSX spreadsheet 27 KB Posted
- Solicitation number
- ERPCS_RFI_2026
About this file
This is a Request for Information (RFI) clarifying questions and government responses document for the Concept Plus ERP Common Services (ERP CS) acquisition by the United States Air Force Materiel Command. The RFI addresses scope, staffing, security, performance standards, and acquisition strategy for a recompete of an incumbent contract (FA8771-26-C-0001, valued historically at $125–135M) to provide cloud infrastructure sustainment and common services on Oracle Cloud Infrastructure (OCI) within the Cloud One environment.
The procurement seeks 70–90 FTE staffing across Program Management Office (PMO) leadership, cloud engineering, DevSecOps, cybersecurity/Risk Management Framework (RMF), Site Reliability Engineering (SRE), and customer support roles. Key personnel must hold certifications aligned with DoD 8140/8570 baseline categories (ranging from IAT II/III for infrastructure roles to IASAE III for architects), and personnel will be classified by security clearance requirement: approximately 10–15% requiring Tier 5 (T5), 60–70% requiring Tier 3 (T3), and 20–30% requiring Tier 1 (T1) investigations. The contract requires continuous 24/7/365 operational coverage with three-tier staffing: Business Hours (0800–1800 ET, Monday–Friday), Core Hours (1000–1600 ET with primary decision-makers available), and Non-Business Hours on-call response. Performance standards include Recovery Time Objective (RTO) of 1 hour and Recovery Point Objective (RPO) of 30 minutes. The anticipated RFP release date is January 2027 with contract award anticipated January 2028 and period of performance beginning January 2028. The Government anticipates full and open competition (no small business set-aside at this stage, though subcontracting goals of 10–15% are expected), will provide all Government-furnished equipment and software, and expects contractor-developed code, automation scripts, and Infrastructure-as-Code to be delivered with Government Purpose Rights or better. Work is fully remote. The current environment comprises approximately 4,701 TB of data across four OCI tenancies (Prod, Test, Int, Dev), with ~1,000 Virtual Desktop Infrastructure (VDI) users and ~2,000 cross-customer service users; Cloud One/OCI provisioning is in progress with one customer fully provisioned and two additional customers queued. Current Authorization-to-Operate (ATO) status is on extension through December 2026, with new submittal starting October 2026 and expected completion/approval January 2027.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| ERP CS RFI 2026_Final_Amend 1.pdf | ||
| ERP CS Follow-on RFI_2026_Final.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Concept Plus ERP Common Services (ERP CS) RFI — Clarifying Questions for the Government
| No. | Category | Question to Government | Response |
| 1 | Scope / Current Environment | How many production and non-production environments (Prod, DR/COOP, Dev, Test, Staging, Sandbox) are currently deployed and in scope for sustainment? | 4 OCI Tenancies (PROD/TEST/INT/DEV) across 2 regions. INT is not used. One region is the primary and one is the secondary. Each Customer has 1..n environments for the Customer's Dev/Test/Prod, within Production tenancy |
| 2 | Scope / Current Environment | What are the current Oracle product versions and patch levels in use across the database, middleware, GoldenGate, IAM, analytics, and EBS tiers? | - Oracle Database 19.14.0.0 |
- Oracle HTTP Server (OHS) 12.2.1.4
- Oracle I&AM (OAIM) 12.2.1.4.0
- Oracle Managed File Transfer (MFT) 12.2.1.4
- Oracle SOA 12.1.4.0
- Oracle OSB 12.2.1.4
- Oracle EBS 12.2.10
- Oracle WebLogic 10.3.6
- Oracle Jdeveloper Studio 10.1.2
| 3 | Scope / Current Environment | What is the approximate data volume (TB) currently under management and the volume planned for migration to OCI? | As of today, the total data volume in OCI is approximately 4701 TB. At this time, we do not have any forecasts regarding the volume of future data migrations. |
| 4 | Scope / Current Environment | What is the total user population and the peak concurrent-user count for the in-scope systems? | There are a total of roughly 1000 users that will use the VDI and 2000 users that will use some cross-customer services. |
| 5 | Scope / Current Environment | What is the current state of the Cloud One/OCI provisioning — is the migration complete, in progress, or greenfield? | Cloud One / OCI provisioning is in progress: all compartments are created, one Customer is fully provisioned and being enhanced, and two additional Customer environments are queued for provisioning. |
| 6 | Scope / Current Environment | What is the current ATO status, authorization boundary, and accreditation timeline for the ERP CS environment? | Currnet - on Extension till 12/2026 -- New Submittal Starting 10/2026 -- Expected to be completed and approved 01/2027. |
| 7 | Incumbent / Contract History | Is there an incumbent contractor performing this work today? If so, what is the incumbent contract number, value, and period of performance? | Yes, there is an incumbent contractor. FA8771-26-C-0001 and PoP 1/23/26 - 1/22/28 |
| 8 | Incumbent / Contract History | Is this requirement a recompete of an existing contract, a consolidation of multiple contracts, or an entirely new requirement? | This will be a recompete of an exsiting contract with new additional requirements. |
| 9 | Acquisition Strategy | What is the anticipated set-aside determination (full and open vs. small business set-aside), and if a small business set-aside, which socioeconomic category? | We are anticipating a full and open comeptition; however, the RFIs will provide additional information to the Government on set-asides. |
| 10 | Acquisition Strategy | What is the estimated total contract value, annual funding level, or ceiling for this effort? | The historical value of the previous contract $125-135M. The follow-on estimated value is TBD. Requirements are being refined. |
| 11 | Acquisition Strategy | What are the anticipated RFP release date and contract award date? | RFP/FOPR release anticipated Jan 2027 and award Jan 2028. |
| 12 | Acquisition Strategy | What is the projected period-of-performance start date for the base year? | Jan 2028 - Jan 2029 |
| 13 | Acquisition Strategy | Does the Government have a preferred or directed contract vehicle, or will this be a stand-alone procurement? | IAW executive orders and directives, we must leverage exsiting contract vehicles before a stand-alone procurement. |
| 14 | Acquisition Strategy | What evaluation approach is anticipated (LPTA, Tradeoff/Best Value), and what evaluation factors will apply? | TBD. Evaluation Approach and Factors have not been considered yet. |
| 15 | Staffing / Labor | What is the current or anticipated total staffing level (FTE count) and the labor-category mix? | Expected staffing for a DoD/USAF Program‑of‑Record MSP supporting 10 business‑facing services: 70 - 90 FTE total, including PMO leadership, requirements/migration teams, cloud engineering, DevSecOps, cybersecurity/RMF, SRE/operations, and application/customer support roles. |
| 16 | Staffing / Labor | What positions are designated Key Personnel, and what are their minimum education, experience, and certification requirements? | Key Personnel: Program Manager (PMP, 10+ yrs), Technical Lead (OCI Architect, 8+ yrs), DevSecOps Lead (5+ yrs, IaC/K8s), Cloud Engineer (OCI cert, 3–5 yrs), Cybersecurity Lead (CISSP, RMF), SRE/Operations Lead (5+ yrs), Scrum Master (CSM). (See Q20) |
| 17 | Staffing / Labor | Will the Government release the incumbent's current staffing levels, labor categories, or position descriptions? | TBD. The Government may release certain labor position but not all. |
| 18 | Staffing / Labor | The RFI requires staffing to 90% within 30 days — 90% of what baseline (total authorized/billable positions)? | Correct. Total authorized/billable positions. |
| 19 | Security / Clearance | What personnel security clearance levels are required (e.g., Secret, Top Secret), and what percentage of the staff must hold each level? | This is an unclasssified system, however, all contractor personnel supporting ERP CS shall hold a background investigation level commensurate with their system access. Personnel with direct OCI Console access require a Tier 5 (T5) investigation. Personnel with privileged access to application, middleware, database, OS, or automation layers require a Tier 3 (T3) investigation. All remaining personnel with non‑privileged access require a Tier 1 (T1) investigation. |
Based on the anticipated staffing model, approximately 10–15% of personnel will require T5, 60–70% will require T3, and 20–30% will require T1.
20 Security / Clearance Which specific technical certifications and DoD 8140/8570 baseline categories/levels are required for the team? NOTE: DoD 8140 category and qualification requirements take precedence over all other role definitions, titles, or contractor labor categories.
IaC Engineer (Terraform/Ansible/OCI) – IAT II (8140) – DCWF 451 (System Administrator) – Security+ CE, CySA+, SSCP Senior IaC Engineer – IAT III (8140) – DCWF 452 (Senior System Administrator) – CASP+, CISSP Integration Engineer (COTS-to-COTS) – IAT II (8140) – DCWF 461 (Technical Support Specialist) – Security+ CE Senior Integration Engineer – IAT III (8140) – DCWF 612 (Systems Developer) – CISSP, GCIH Integration Architect – IASAE III (8140) – DCWF 632 (Security Architect) – CISSP + ISSEP/ISSAP DevSecOps Integrator – IAT III / CSSP Infrastructure (8140) – DCWF 621 (DevOps Specialist) – Security+, CySA+, CEH Security Automation Engineer – CSSP Infrastructure (8140) – DCWF 531 (Cyber Defense Infrastructure Support Specialist) – CEH, CySA+, GICSP CI/CD Pipeline Engineer – IAT II (8140) – DCWF 621 (DevOps Specialist) – Security+ CE Senior CI/CD Engineer – IAT III (8140) – DCWF 621 (DevOps Specialist – Senior) – CASP+, CISSP Monitoring/Telemetry Integrator – CSSP Infrastructure (8140) – DCWF 511 (Cyber Defense Analyst) – CySA+, GICSP Program Manager – IAM III (8140) – DCWF 801 (Program Manager) – CISSP, CISM, GSLC, PMP (recommended)
| 21 | Security / Clearance | Is a facility clearance (FCL) required for the prime contractor, and at what level? | No |
| 22 | Place of Performance | What is the place of performance — on-site at Maxwell AFB-Gunter Annex, contractor facility, fully remote, or hybrid — and what is the anticipated on-site vs. remote split? | Fully Remote. |
| 23 | Place of Performance | Will Government-furnished workspace, equipment, network access, and credentials be provided for on-site personnel? | Yes |
| 24 | Transition | What is the anticipated transition-in period, and will phase-in be a separately priced CLIN? | Transition-in period will be 3-4 months and separately priced CLIN. |
| 25 | Transition | Will the incumbent be required to support transition, and what knowledge-transfer artifacts (runbooks, architecture docs, configs) will be available? | There will be a Transition-Out Plan at least 120 days prior to contract expiration. The plan will contain timelines, resource allocations, risk assessments, and communication strategies. It will have key activities such as knowledge transfer sessions, documentation handover, and coordination meetings. |
| 26 | Roles & Responsibilities | What is the responsibility boundary (RACI) among the contractor, Cloud One, DISA, and Oracle for infrastructure, platform, and application-layer activities? | Government PMO (Cloud One = Accountable) | Oracle = Responsible for underlying cloud infrastructure | Contractor = Responsible for tenant‑level provisioning, operations, and application level administration as well as integrations. |
| 27 | Performance Standards / SLAs | What are the specific service-level requirements and performance thresholds the contractor will be measured against for 24/7/365 support? | Coverage Model |
The Contractor shall provide continuous operational coverage (24/7/365) for all provisioned services within the Mini Data Center, including Zone A and Production environments and associated failover, continuity, and disaster recovery sites. Coverage is structured into three tiers as follows.
Business Hours Coverage Timeframe: 0800 to 1800 Eastern Time, Monday through Friday Exclusions: Federal holidays and any additional days designated by the President of the United States as leave/pass days for Federal workers Requirements:
| • | The Contractor shall maintain full staffing during this window, meaning sufficient personnel actively on duty to perform all operational functions without delay or degradation. |
| • | Functions covered include: |
| • | Incident Response – Real-time triage and resolution of alerts and service disruptions |
| • | Change Execution – Implementation of approved changes with rollback capability |
| • | Customer Support – Timely response to ITSM tickets and service requests |
| • | Monitoring – Active review of dashboards and telemetry; not reliant solely on automated alerts |
| • | Staffing levels must support parallel handling of multiple incidents and requests without bottlenecks. |
Core Hours Coverage Timeframe: 1000 to 1600 Eastern Time, Monday through Friday Exclusions: Same as Business Hours Requirements:
| • | All critical functions must be staffed with primary personnel — not backups, alternates, or on-call resources to respond to all communication methods. |
| • | This includes: |
| • | Primary incident responders |
| • | Primary change implementers |
| • | Primary monitoring analysts |
| • | Primary customer support representatives |
| • | The Contractor shall ensure that decision-makers and technical leads are directly available and responsive during this window. These individuals must be empowered to coordinate, approve, escalate, and resolve operational matters without delay. |
Note: Core Hours are the preferred window for coordination, approvals, and escalations. The Government expects direct access to contractor decision-makers and technical leads during this time.
Non‑Business Hours Coverage Timeframe: All other hours, including evenings, weekends, holidays, and overnight periods Exclusions: n/a Requirements:
| • | The Contractor shall maintain: |
| • | Active Monitoring – Continuous telemetry collection and automated analysis using Government‑provided tools. Alerts must be generated for threshold breaches, anomalies, or failures and transmitted in real time to designated on-call personnel. |
| • | On‑Call Incident Response Capability – A roster of qualified personnel available 24/7/365 to respond to alerts. On-call staff must: |
| • | Acknowledge alerts within SLA-defined timeframes |
| • | Initiate triage, escalation, or resolution actions per approved runbooks |
| • | Document all actions in the ITSM system |
| 28 | Performance Standards / SLAs | What are the defined RTO and RPO targets for DR/COOP, and how is "near real-time replication" quantified? | RPO for all data is 30 minutes. RTO is broken into Tiers of Services offered. highest level is 1 hour. |
| 29 | GFE / GFP / Tools | What Government-furnished equipment, information, property, and software tools/licenses (ITSM, monitoring, test automation, CI/CD) will be provided versus contractor-furnished? | The government will provide all authorized equipment, property (to include computers), and software required. |
| 30 | GFE / GFP / Tools | What is the current DevSecOps pipeline, test-automation framework, and monitoring/ITSM toolset in use today? | Jenkins/Flexdeploy + ConfigSnapshot, MicroFocus Fortify, MicroFocus UFT, SmartBear ReadyAPI, ServiceNow ATF, may be integrating Arcturus (Cloud One), utlSQL, FormsDataLoader, Evaluate STIG |
| 31 | Documentation / Engagement | Will the Government release a draft PWS, current PWS, SLAs, CDRL list, or QASP for industry review prior to or with the RFP? | Yes, a draft PWS will be released prior to final issuance of RFP/FOPR. |
| 32 | Documentation / Engagement | Will there be an Industry Day, site visit, or one-on-one sessions before the RFP is released? | We will have POCs at DAFITC and can request a mtg through BES Stratcom. |
| 33 | AI Implementation | Are there specific AI/ML use cases, data-governance constraints, or approved AI tooling/platforms (e.g., approved models, AI services on OCI) the Government envisions, and what authorization process applies to AI capabilities within the boundary? | AFLCMC GBA ERP CS, use case: utilize AIOps to automate DevSecOps, environment provisioning, and compliance monitoring across your 70+ Oracle Cloud database and application offerings. |
. Instead of manually reviewing logs and configurations for massive customer base (DEAMS, MRO, MilPDS), AI can proactively detect drift, accelerate the Risk Management Framework (RMF) process, and automate the optimization of shared Cloud One infrastructure 34 Data Rights / Compliance What data-rights and licensing posture does the Government expect for custom-developed code, automation scripts, and IP delivered under this effort? The Government expects all custom‑developed software, automation scripts, IaC, configuration templates, and mission‑specific IP produced under this effort to be delivered with Government Purpose Rights (GPR) or better.
This includes:
Custom application code Automation scripts (CI/CD, test automation, deployment automation) Infrastructure‑as‑Code (Terraform, Ansible, Helm, etc.)
Configuration baselines Monitoring/observability integrations Custom APIs, microservices, and platform extensions Documentation and design artifacts
If development is fully Government‑funded, the Government typically expects Unlimited Rights under DFARS 252.227‑7013/7014.
If development is partially contractor‑funded, the Government expects Government Purpose Rights at minimum.
| 35 | Data Rights / Compliance | Can the Government confirm the governing FAR/DFARS clauses, the applicable Organizational Conflict of Interest framework (the RFI cites "RFO 9.5"), and any deviations or class deviations applicable to this procurement? | The regulation will follow the Revolutionay FAR Overhaul; however, the clauses could be RFO/FAR/DFARS/R-DFARS with regard to the Organizational Conflict of Interest disclosures. |
| 36 | Data Rights / Compliance | For NAICS 541511, will the standard size standard apply, and is small-business participation (e.g., a subcontracting goal) expected of large-business primes? | Yes, small business size standards apply. Subcontracting goals will be between 10-15%. |
| 37 | Scope | would you consider a stand alone Benefits Administration system to run alongside and integrate with your eventual ERP system? | To clarify, the scope of this RFI is centered on the ERP CS and its portfolio of shared technical services that operate within Cloud One on Oracle Cloud Infrastructure (OCI). ERP CS is a Government‑run service provider that delivers accredited environments, integration capabilities, DevSecOps pipelines, data services, and enterprise guardrails that mission systems consume. |
The RFI is not seeking standalone mission or business applications—such as a Benefits Administration system—nor is it evaluating functional system replacements. Mission owner applications remain the responsibility of their respective functional communities and are outside the scope of ERP CS shared services acquisition.
File details come from the government source that posted it. Updated .