Crash Net System Questions and Answers.pdf

Question:

1. JITC Certification Requirement CLIN 0016 references "DoD / JITC Certified Installation." Please clarify whether this requirement applies to:

JITC Requirement no longer required. See attached memo

2. Required Documentation If "DoD / JITC Certified Installation" is required, what documentation must be submitted with the quotation or prior to award as proof of compliance?

See answer to question 1.

3. Installer Certifications Are contractor personnel required to possess any specific certifications to perform installation services under this requirement? If so, please identify the required certifications and acceptable proof.

Certification from Forum that they are a licensed installer.

Any commercial certification such as electrical required for the work.

“All supervisors and installers assigned to the installation of this system or any of its components shall have factory certification from each equipment manufacturer that they are qualified to install and test the provided products.”

4. OEM Certification Does the Government require installation to be performed by an OEM-authorized or OEM-certified installer for the proposed Forum Communications ConsortAlert system?

Also see 3.

Yes. This required to keep warranty and to ensure proper programming.

5. Technician Training Requirements Are technicians required to complete any OEM, DoD, Air Force, or site-specific training prior to performing installation activities?

Security training as necessary provided by Tinker AFB

6. Low-Voltage / Cabling Certifications Does the Government require installers to possess any structured cabling, fiber-optic, telecommunications, or low-voltage certifications (e.g., BICSI, FOA, manufacturer certifications)?

Also see 3.

7. Electrical Licensing Are any state, local, or federal electrical licenses required for installation of UPS systems, power distribution units, PoE switches, or related equipment?

Licensing as required by Federal and State law. Generally, plug-and-play UPS (ones that simply plug into a wall outlet and are less than 3kVA) do not require a professional license.

Hardwired ones do, as does any installation of electrical outlets/breakers/etc.

8. Fiber Infrastructure Responsibilities Will the Government provide all fiber infrastructure in a tested and operational condition, or is the contractor responsible for fiber testing, certification, termination, and remediation?

Government will provide fiber and LAN (CAT6) infrastructure in a tested and operational condition.

9. Testing Requirements Are there any required acceptance testing standards, certification reports, or commissioning documentation that must be provided upon project completion?

Yes. A Site Acceptance Test (SAT) or System Operational Verification Test (SOVT) is the standard DoD requirement before the Government signs off on completion and assumes maintenance responsibility.

10. Certifications Required with Quote Please identify all certifications, accreditations, authorizations, and training records that must be included with the quotation to be considered technically acceptable.

Recommended to be technically acceptable, vendors must provide the DoDIN APL Memo, OEM authorization letters, and any mandatory corporate certification

**Please find below the DoDIN APL FAQ**

11. Post-Award Certifications If certain certifications are not required at proposal submission, at what point in contract performance must they be provided?

No - but must be approved reseller/installer by Forum

12. Regarding the referenced solicitation, are there any clearance requirements for staff performing installation services?

No security clearance is required but personnel must obtain either a Defense Biometric Identification System (DBIDS) card or a local visitor pass. Personnel must successfully clear a National Crime Information Center (NCIC) background check.

Upon arrival, they must present a REAL ID-compliant state driver's license, passport, or other federally recognized identification at the installation's Visitor Control Center

(VCC).

13. Shipping Address 7330 Sentry Road, Bldg 469, Door 33, Rm100, Tinker AFB, OK 73145

DoDIN Approved Products List Sunset FAQ

Q: When does the APL officially sunset?

A: The DoDIN APL will be formally sunset on 30 September 2025, under DoD CIO authority.

Q: Will products still be tested after that date?

A: JITC interoperability testing will continue through 31 December 2025 for vendors already in the pipeline.

Q: What will replace the APL program?

A: Cybersecurity requirements will transition to vendor STIGs through DISA Risk Management Directorate. Interoperability requirements will be defined in UCR-CORE and enforced through contractual provisions. Products will no longer be tested for interoperability; rather, UC systems will be tested to ensure interoperability of the system inclusive of UC products.

Q: Will historical APL data remain available?

A: Yes, DISA remains committed to maintaining the repository of approved DoDIN APL products through Fiscal Year 2026.

Q: How will cybersecurity be validated going forward?

A: Cybersecurity validation will transition to the Vendor STIG program, which provides product-specific security hardening baselines.

Q: How will interoperability be validated going forward?

A: Interoperability requirements will transition to the UCR-CORE, enforced via acquisition contracts beginning Fiscal Year 2026.

Q: What happens to the Military Unique Deployment Guidance (MUDG)?

A: The MUDG documents will be transitioned to https://www.cyber.mil within the STIG area. Guidance will be provided to the vendors to transition their MUDG to a STIG on upgrade of product or sunset the document when the product is no longer supported.

Q: How do vendors start the Vendor STIG process?

A: Vendors should engage with the DISA RME vendor STIG process through submission of the Vendor STIG Intent Form available at http://www.cyber.mil/stigs/vendor-process. The completed form is submitted to disa.stig_spt@mail.mil. Once a vendor request is submitted, the review process will commence, and the vendor will be engaged by the STIG team.

Q: Are there major risks with this transition?

A: The primary risk is the development of the UCR-CORE. The existing UCR will remain in effect until publication of UCR-CORE. The initial draft is expected by 30 January 2026.

Q: What is the system used for within DISA?

A: The APL Program was utilized to maintain a single consolidated list of products that have completed Interoperability and Cybersecurity certification to support operational use on DoD Networks via the Approved Products List (APL). The Approved Products Certification Office (APCO) maintained the Approved Products List Integrated Tracking System (APLITS), which is the web application utilized for tracking the DoDIN APL to include the testing processes, removal list sites, the current UCR document, and all APL testing artifacts.

Q: Why was the change made from the previous system?

A: Technical standards have matured since the APL process was originally established with a corresponding reduction in interoperability challenges. The DoD CIO, in collaboration with DISA, conducted an assessment and determined that other processes exist to ensure industry compliance with DoD requirements to enhance security, reliability, interoperability, and trust in the DoDIN.

Q: Who will it affect?

A: It will affect every effort that secures, operates, designs, or maintains components or systems on the DoDIN. UCR-CORE will focus on Voice, Video, and Chat along with the technologies that impact delivery of those services across the DoDIN. The Sunsetting APL program highlighted those technologies by focusing on “Device Types”, but the new process will focus more on technologies and system interoperability with the leveraged products.

Q: What will replace the program?

A: Interoperability requirements will be in the updated UCR-CORE document and will be enforced through contractual provisions. Cybersecurity testing will be replaced with vendor STIGS.

Q: Will the new system change the way DoD operates?

A: Yes. Contracts for UC products will require compliance with the UCR-CORE and development of a Vendor STIG instead of UC APL certification. Implementation of the product within a system will require implementation of the Vendor STIG as opposed to a

MUDG.

Q: When does the migration, if any, start?

A: The sunset date is September 30, 2025.

Q: What will DoD programs that need UC capabilities do?

A: You will need to understand if/how UCR-CORE impacts your system or program. Plan and secure resources to validate system interoperability and ensure contractual compliance to the extent required for your contract and program. Additionally, programs or systems will leverage vendor STIGs to secure the UC products used by the program or system instead of APL cybersecurity documents previously provided.

Q: How do I access the list of approved products under the legacy program?

A: To maintain transparency and continuity, DISA remains committed to maintaining the repository of approved DoDIN APL products through Fiscal Year 2026.

• The DoDIN APL is publicly accessible at https://aplits.disa.mil/apl

• The Approved Products Certification Office (APCO) will continue to provide support to the APL distributed test labs, the Joint Interoperability Test Command (JITC), and the DISA Risk Management Directorate to ensure all final reporting and certification deliverables are completed.

Q: What about small business vendors?

A: The Department is coordinating with industry to ensure STIG participation remains accessible to small businesses. This change, because there is no cost to participate, increases opportunities for small business vendors.

Q: How will staffing demands at DISA be managed?

A: Additional STIG resources have been added to the team to manage the increase in workload.

Q: Why is this happening now?

A: The APL sunset eliminates duplicative processes, reduces costs, and aligns with DoD modernization goals and objectives.