Joint_Base_Charleston_Generator_Monitoring_RFI_Responses.pdf

DEPARTMENT OF THE AIR FORCE

JOINT BASE CHARLESTON (628TH AIR BASE WING)

Document Type: Official Responses to Contractor Requests for Information (RFI)

Project Title: Generator Fleet Monitoring & Cybersecurity Integration

1. INSTRUCTIONS TO OFFERORS

This document constitutes the official Government responses to Requests for Information (RFIs) submitted by prospective contractors.

1. Contractual Precedence: These responses clarify and supplement the technical specifications, Statement of Work (SOW), and solicitation requirements.

2. Pricing Baseline: Offerors must base their Firm-Fixed-Price (FFP) proposals on the explicit directions, assumptions, and guidance provided below.

3. Security Standards: All proposed hardware, software, and configuration methodologies must strictly adhere to the Department of the Air Force and DoD cybersecurity mandates referenced herein.

2. RFI QUICK-REFERENCE INDEX

RFI

Topic / Area of Inquiry Direct Policy / Standard Reference

Network Diagrams, Switch Inventories &

IP Addressing

Controlled Unclassified Information

(CUI) Policy

FIPS 140-2 / FIPS 140-3 Cryptographic

Validation

DAFGM2026-32-01 (Paras 3.3.5, 3.4.5.1.2, 3.4.7)

RFI

Topic / Area of Inquiry Direct Policy / Standard Reference

03 Pre-Award Site Visits Joint Base Charleston OPSEC

Guidelines

04 Network Switch Replacement Boundaries DAFGM2026-32-01 (Para 3.6.2) / DISA

APL

05 Testing & Acceptance Criteria Post-Installation Closeout

Requirements

Government-Furnished Network

Connectivity & IPs SOW Section Boundary

07 Monitoring Platform / OEM Equivalency Brand Name or Equal Policy

Minimum Monitored Devices & Future

Capacity Fleet Scaling & Hardware Baseline

Known Incompatible Generators / ATS

Controllers

LonWorks-to-Modbus Protocol

Gateways

Vulnerability Scanning & Remediation

Responsibility

DAFGM2026-32-01 (Paras 3.3.10 &

3.3.12)

Identification of Existing Government

Switches Base Infrastructure Boundaries

Historical Trending, Event Logging &

Data Retention Buffering and Logging Minimums

13 Unknown/Legacy Interfaces Under FFP FAR Contract Modification Procedures

FortiGate Licensing & Management

Requirements IPsec VPN Tunnel Baseline

15 Initial Configuration Responsibility Post-Award Gov-Furnished IP / VPN

Parameters

16 Trade Agreements Act (TAA) Compliance TAA Federal Mandate

Cabling & Network Drop Physical

Boundaries SOW Demarcation (RJ45 Hand-off)

Topic / Area of Inquiry Direct Policy / Standard Reference

18 Acceptability of Unmanaged Switches DAFGM2026-32-01 (Para 3.6.2) / DISA

APL

Generator/ATS Site Photos & Estimating

Assumptions Phased Post-Award Physical Discovery

General Solicitation Drawings & Critical

GIS Site Data

Operational Security (OPSEC) / Critical

Infrastructure

System Functional Scope: Monitoring vs.

Control Monitoring-Only Policy

Civil Network Infrastructure Cabling

Boundary

SOW Demarcation (Civil Works

Excluded)

Hardware, Enclosures & Managed

Switches

Weatherproof NEMA 4X & DISA APL

Mandates

Cybersecurity, RMF & FIPS Compliance

Framework COIN Enclave RMF & GFE Scans

Proposal Pricing Basis & Differing Site

Conditions

Fleet Size Schedule & Standard FAR

Clauses

Functional Requirements: Telemetry &

Retention Telemetry Point List & Data Buffering

Pre-Award Network Topology & CUI Data

Releases

Controlled Unclassified Information

(CUI) Post-Award

Physical Demarcation Point & Civil

Infrastructure RJ45 Enclosure Termination Boundary

29 Contractor Switch Integration Guidelines DISA APL Managed Switch

Requirements

30 Permanent Equipment Power Provision Gov-Furnished Power (AC/DC) &

Buffering

Standalone Server, Operator Stations &

Central HMI

Centralized HMI & Local Infrastructure

Scope

Topic / Area of Inquiry Direct Policy / Standard Reference

Cybersecurity Framework, RMF Artifacts

& FIPS

COIN / DAFGM2026-32-01 Compliance

Operational Testing & Final System

Acceptance End-to-End Configuration Validation

Target Delivery Date (December 18, 2026) Final Closeout & Lead-Time Phasing

Operational Security & Pre-Award Site

Access Joint Base Charleston OPSEC Policy

Mandate for FIPS-Validated Inline

Security Appliances

FIPS Cryptographic Compensating

Controls

Enclave Traffic Encryption vs. Firewall

Isolation

DAFGM2026-32-01 IPsec Tunnel

Mandate

Required Bid Items: Enclosures, Buffers, HMI, Alarms Turn-key Firm-Fixed-Price Scope

3. OFFICIAL RFI RESPONSES

RFI-01: Network Diagrams, Switch Inventories & IP Addressing Schemes

Government Response: No pre-award network diagrams or IP schemes will be provided. This information is Controlled Unclassified Information (CUI) and will only be provided to the winning contractor post-award on a need-to-know basis. The Government

(628 CS / CE) will provide all IP addressing, subnetting, and VLAN configurations post-award.

RFI-02: FIPS 140-2 / FIPS 140-3 Cryptographic Validation

Government Response: Yes, FIPS validation is mandatory. Per DAFGM2026-32-01

(Paras 3.3.5, 3.4.5.1.2, 3.4.7), all data-in-transit traversing the base network enclave must utilize FIPS 140-2 or FIPS 140-3 validated encryption (e.g., IPsec VPN tunnel, TLS

1.3, SSH v2.0+). If an edge gateway is not natively FIPS-validated, the contractor must bundle an approved inline FIPS-validated security appliance (e.g., Cisco ISA 3000, Fortinet FortiGate Rugged 60F) as a compensating control.

RFI-03: Pre-Award Site Visits

Government Response: Due to operational security, time constraints, and the geographic dispersion of generator assets across Joint Base Charleston (Air Base and NWS), pre-award site visits will not be conducted. Offerors must base their proposals on the generator schedule and technical specifications provided in the solicitation.

RFI-04: Network Switch Replacement (Base Infrastructure vs. Contractor

Hardware)

Government Response: Offerors will NOT replace base network infrastructure switches.

Base switches are Government-owned and maintained by the 628th Communications

Squadron. However, per DAFGM2026-32-01 (Para 3.6.2), any switch provided by the contractor inside vendor enclosures (such as the HMI panel) MUST be a managed switch on the DISA Approved Products List (APL). Unmanaged switches are strictly prohibited.

RFI-05: Testing & Acceptance Criteria

Government Response: System acceptance criteria includes:

1. Verified end-to-end data communication from each generator controller to the central monitoring interface/HMI.

2. Telemetry point validation (Engine Running/Not Running, Auto/Manual mode, Common Fault, battery voltage, fuel level).

3. Alarm/event annunciation, acknowledgment, and audible/visual alert verification.

4. FIPS-validated encrypted tunnel operational validation.

5. Submission of post-installation documentation: as-built wiring/network diagrams, IP tables, configuration backups, and RMF artifact documentation.

RFI-06: Government-Furnished Network Connectivity & IP Addressing

Government Response: Yes. The Government (628 CS) will provide physical network drops (cabling/terminations) to the generator enclosure locations and furnish all required private IP addressing and network routing. The contractor ’s scope is edge hardware installation, controller interfacing, and logical configuration to the provided drop.

RFI-07: Monitoring Platform / OEM Equivalency

Government Response: This is an open-architecture, brand-name-or-equal solicitation.

Offerors may propose an equivalent monitoring platform provided it meets all functional monitoring capabilities, protocol integration requirements (Modbus, J1939, CDL, etc.), TAA compliance, and DAF/DoD cybersecurity mandates.

≈ 65

RFI-08: Minimum Monitored Devices & Spare Capacity

Government Response: The baseline project scope encompasses approximately generator systems (and associated ATS units where applicable). The proposed system architecture and central software/HMI must support these units plus a minimum future expansion capacity (minimum total nodes) without requiring software replacement or major architectural redesign.

RFI-09: Known Incompatible Generators / ATS Controllers

Government Response: As detailed in the provided generator list, approximately older Cummins units (equipped with PCC 2100/3100/3200 controllers) require LonWorks-to-Modbus protocol gateways (e.g., FT-10 cards / ProtoNodes). Offerors must include necessary protocol translation gateways/cards in their proposal. Full OEM engine controller replacements are not required.

RFI-10: Vulnerability Scanning & Remediation Responsibility

Government Response: This is a joint responsibility per DAFGM2026-32-01 (Paras

3.3.10 & 3.3.12). The contractor must conduct initial vulnerability scans of all delivered hardware/firmware, provide scan reports, and document mitigations prior to final acceptance. The Government (CE ISSM/ISSO and 628 CS) will perform validation scans using Government Furnished Equipment (GFE) prior to granting Authority to Connect

(ATC) to the network enclave.

RFI-11: Identification of Existing Switches to Remain in Service

Government Response: See response to Question 4 (RFI-04). All existing base facility network switches remain in service under Government management. The contractor is only responsible for contractor-furnished switches within their own assemblies (which must be DISA APL managed switches).

RFI-12: Historical Trending, Event Logging & Data Retention

Government Response: Yes. Edge devices must provide onboard data buffering

(minimum days of offline event/fault logging during network loss). The central monitoring/HMI solution must provide historical trending, alarm logging, and minimum -year searchable event retention.

65 25%

RFI-13: Unknown/Legacy Interfaces Under Firm-Fixed-Price (FFP)

Government Response: Offerors should structure their fixed-price proposal using the provided generator schedule, pricing standard communication modules/gateways

(Modbus, J1939, CDL, ProtoNode) across the fleet. Discovery will occur in phases during deployment. Any edge unit requiring modifications fundamentally outside the scope of the solicitation will be addressed via standard FAR contract modification procedures with the

Contracting Officer.

RFI-14: FortiGate Licensing & Management

Government Response: Standard/Unified threat protection licensing is sufficient.

Enterprise subscriptions or centralized FortiManager licenses are not required. The primary purpose of the appliance is to establish a FIPS-compliant IPsec tunnel to the base enclave.

RFI-15: Initial Configuration

Government Response: The vendor is not expected to know the base network configurations prior to installation. Post-award, the Government (628th Communications

Squadron / CE Cyber) will provide the required IP addressing schemas, subnets, and pre-shared VPN parameters for the vendor to configure the appliances.

RFI-16: TAA Compliance

Government Response: Yes, Trade Agreements Act (TAA) compliance is strictly mandatory for all hardware procured for this project, including any third-party security appliances (e.g., Fortinet).

RFI-17: Cabling & Network Drops

Government Response: Confirmed. As defined in the Statement of Work, the

Government is responsible for routing external physical network cabling to the generator sites. The vendor's physical network responsibility ends at the RJ45 handoff inside their provided enclosure.

RFI-18: Unmanaged Switch in HMI Panel

Government Response: No, an unmanaged switch is not acceptable. Per the newly released Department of the Air Force Guidance Memorandum DAFGM2026-32-01 (Para

3.6.2), all control systems must utilize managed network switches that are on the DISA

Approved Products List (APL) to enforce physical and logical port security. The vendor must revise their quote to include a compliant managed switch.

RFI-19: Generator/ATS Photos & Information

Government Response: Due to time and manpower constraints, the Government will not be providing the requested site photos prior to the quote deadline. The vendor should proceed by assuming all unverified units require the additional communication cards/ProtoNodes and price them into the proposal accordingly. Physical verification can be performed by the vendor during the phased installation process.

RFI-20: General Solicitation, Drawings & Site Data

Government Response:

In accordance with operational security (OPSEC) and critical infrastructure protection guidelines, no electrical one-line diagrams, building floor plans, GIS/KMZ files, telecommunications room locations, or pre-award site visits will be provided.

Offerors must base their firm-fixed-price proposals on the generator schedule and specifications provided in the solicitation. Detailed physical mounting locations and facility access will be coordinated post-award during the project kickoff and phased rollout.

RFI-21: System Scope: Monitoring vs. Control

Government Response:

This project is strictly MONITORING ONLY. No remote-control capabilities (e.g., remote generator start/stop, remote ATS transfer, or remote exercise initiation) are permitted or required.

The system is an independent, turn-key monitoring solution delivering engine telemetry (Run/Stop, Auto/Manual, Faults, Battery Voltage, Fuel Level) to the contractor-provided central HMI display. Base GIS mapping engines and sequence-of-events recording are out of scope.

RFI-22: Network Infrastructure & Cabling Boundary

Government Response:

As stated in the SOW, the Government (628 CS) is responsible for routing all external physical network cabling and installing active network drops to the generator enclosures. The Contractor is NOT responsible for civil trenching, boring, or pulling base fiber/copper between buildings.

The Contractor ’s responsibility begins at the RJ45 handoff inside the contractor-furnished generator enclosure.

RFI-23: Hardware, Enclosures & Managed Switches

Government Response:

Offerors must provide turn-key edge hardware packages in weatherproof, lockable

NEMA 4X enclosures mounted adjacent to or on the generator housings.

Protocol conversion gateways (Modbus, J1939, CDL, ProtoNode for older

Cummins units) must be included by the offeror to interface with the existing controllers listed in the equipment schedule. Full engine controller replacements are not required.

Per DAFGM2026-32-01 (Para 3.6.2), any network switch provided by the contractor (e.g., inside the HMI assembly) must be a managed switch listed on the

DISA Approved Products List (APL).

RFI-24: Cybersecurity, RMF & FIPS Compliance

Government Response:

The system will reside within the Civil Engineering control systems network enclave

(COIN).

FIPS 140-2/3 validation is mandatory for all data-in-transit traversing the network enclave. If edge gateways lack native FIPS validation, an inline FIPS-validated micro-firewall (e.g., Cisco ISA 3000, Fortinet FortiGate Rugged 60F) must be bundled as an approved compensating control.

All hardware must be TAA compliant. Wireless, Bluetooth, and cellular connections are strictly prohibited (DAFGM2026-32-01, Para 3.4.5.1.6).

The Contractor is responsible for providing standard vendor RMF artifacts

(hardware/software lists, port/protocol/service sheets, architecture diagrams, and initial vulnerability scan results). Formal RMF package submission into eMASS and

ATO/ATC approvals are Government responsibilities.

RFI-25: Proposal Basis & Differing Conditions

Government Response: Pricing must be based on the units listed in the solicitation. Physical discovery and verification of unconfirmed communication cards will take place post-award during the phased installation. Any unforeseen condition fundamentally outside the solicitation scope will be handled via standard FAR contract modification procedures with the Contracting Officer.

RFI-26: Required Monitoring Functions

Government Response: This project is strictly MONITORING ONLY. No remote control capabilities (e.g., remote generator start/stop, remote exercise, or remote ATS transfer commands) are permitted or required. The system will deliver basic engine telemetry

(Run/Stop, Auto/Manual, Faults, Battery Voltage, Fuel Level) to the contractor-provided central HMI display. Onboard edge devices must provide data buffering (minimum days of offline event/fault logging during network loss), and the central software/HMI solution must provide historical trending and a minimum of -year searchable event retention. Polling and screen-refresh intervals are expected to align with standard industry monitoring practices for utility systems.

RFI-27: Existing Network Infrastructure, Diagrams & Drawings

Government Response: In accordance with operational security (OPSEC) and critical infrastructure protection guidelines, no electrical one-line diagrams, physical floor plans, GIS/KMZ files, telecommunications room locations, switch models, or pre-award network topologies will be provided. This information is Controlled Unclassified Information (CUI) and will only be provided to the winning contractor post-award on a need-to-know basis.

Detailed physical mounting locations and facility access will be coordinated post-award.

RFI-28: Network Construction & Cabling Boundary

Government Response: As stated in the SOW, the Government (628 CS) is responsible for routing all external physical network cabling and installing active network drops to the generator enclosures. The Contractor is NOT responsible for civil trenching, boring, building penetrations, or pulling base fiber/copper between facilities. The Contractor ’s physical boundary and responsibility begins at the RJ45 handoff inside the contractor-furnished generator enclosure.

RFI-29: Network Switch Replacement

Government Response: Offerors will NOT replace base network infrastructure switches.

Base switches are Government-owned and maintained by the 628th Communications

Squadron. However, per DAFGM2026-32-01 (Para 3.6.2), any network switch provided by the contractor inside vendor enclosures (such as the HMI panel) MUST be a managed switch listed on the DISA Approved Products List (APL). Unmanaged switches are strictly prohibited.

RFI-30: Permanent Equipment Power

Government Response: The Government will provide standard operating power options

(AC) at the HMI location and DC starting battery access ( ) at the generator enclosures. If the contractor's specific monitoring components require secondary power conditioning, the contractor must supply appropriate AC/DC power supplies or surge protection within their enclosures as part of their turn-key proposal.

12 VDC/24 VDC

RFI-31: Server, Operator & HMI Equipment

Government Response: The contractor must provide a complete, standalone centralized HMI package (display, processor, and mounting enclosure) to monitor fleet-wide status, telemetry, and alarms. On-premise server architecture and physical server-room rack space are out-of-scope. Redundancy, concurrent user count, and backup systems must align with standard commercial best practices for a -node fleet.

RFI-32: Cybersecurity, RMF & FIPS Compliance

Government Response: The system will reside within the Civil Engineering control systems network enclave (COIN). FIPS 140-2/3 validation is mandatory for all data-in-transit traversing the network enclave. If edge gateways lack native FIPS validation, an inline FIPS-validated micro-firewall (e.g., Cisco ISA 3000, Fortinet FortiGate Rugged 60F) must be bundled as an approved compensating control. Wireless, Bluetooth, and cellular connections are strictly prohibited (DAFGM2026-32-01, Para 3.4.5.1.6). The Contractor is responsible for providing standard vendor RMF artifacts (hardware/software lists, port/protocol/service sheets, architecture diagrams, and initial vulnerability scan results).

Formal RMF package submission into eMASS and ATO/ATC approvals are Government responsibilities.

RFI-33: System Acceptance Criteria

Government Response: System acceptance criteria includes:

1. Verified end-to-end data communication from each generator controller to the central monitoring interface/HMI.

2. Telemetry point validation (Engine Running/Not Running, Auto/Manual mode, Common Fault, battery voltage, fuel level).

3. Alarm/event annunciation, acknowledgment, and audible/visual alert verification.

4. FIPS-validated encrypted tunnel operational validation.

5. Submission of post-installation documentation: as-built wiring/network diagrams, IP tables, configuration backups, and RMF artifact documentation.

RFI-34: December 18, 2026 Delivery Date

Government Response: The December 18, 2026 date represents the final target date for physical installation, operational testing, and submission of final project closeout deliverables. Offerors may propose an alternate phased timeline if required by equipment lead times, which will be evaluated during the source selection process.

RFI-35: Site Visit

Government Response: Due to operational security, time constraints, and the geographic dispersion of generator assets across Joint Base Charleston, pre-award site visits will not be conducted. Offerors must base their proposals on the generator schedule and technical specifications provided in the solicitation.

RFI-36: Requirement for FIPS-Validated Inline Appliance

Contractor Query: Please confirm that the Fortinet device or similar is indeed required and should be included in the bid.

Government Response: Yes, confirmed. In accordance with Department of the Air Force and DoD cybersecurity mandates (and DAFGM2026-32-01), all devices operating on the

Civil Engineering Control Systems network (COIN) must comply with FIPS cryptographic standards. Because the proposed edge gateway lacks native FIPS 140-2/3 validation, an inline, FIPS-validated security appliance (such as a Fortinet FortiGate Rugged 60F, Cisco

ISA 3000, or equivalent TAA-compliant device) must be included in the proposal as an approved compensating control.

RFI-37: Encryption vs. Firewall/Isolation

Contractor Query: Please confirm whether the traffic needs to be encrypted, and if not, that the gateway acts simply as a firewall and management access point.

Government Response: Traffic MUST be encrypted using FIPS-validated cryptography.

Per DAFGM2026-32-01 (Paras 3.3.5 & 3.4.7), all telemetry data-in-transit traversing the network enclave must be protected via FIPS-validated cryptographic modules (e.g., establishing a secure IPsec VPN tunnel from the edge appliance back to the central enclave boundary). The inline appliance serves as both a FIPS encryption endpoint and a stateful firewall.

RFI-38: Inclusion of Enclosures, Power Buffering, Central HMI, and Alarms

Contractor Query: Please confirm for each item whether we should include it in the bid

(Padlockable enclosure, DC power buffer, Centralized HMI, Audible/Visual alarm annunciation) and whether they should be broken out in a supplement or included in the primary submission.

Government Response: All four (4) items ARE REQUIRED and must be included in the primary firm-fixed-price proposal/CLIN structure as part of the turn-key solution:

1. Padlockable Enclosure: Required. A lockable, weatherproof NEMA 4X enclosure must be provided at each generator site to house the gateway, security appliance, and associated hardware (DAFGM2026-32-01, Para 4.5.1).

2. DC Power Buffer: Required. The contractor must provide power conditioning/buffering to prevent brownouts/reboots of the gateway and security appliance during generator engine cranking.

3. Centralized HMI: Required. The contractor must provide a complete centralized

HMI package (display, processor, and mounting enclosure) to monitor fleet-wide status, telemetry, and alarms. (Reminder: Per DAFGM2026-32-01 Para 3.6.2, any internal network switch within the HMI enclosure must be a DISA APL managed switch).

4. Audible and Visual Alarm Annunciation: Required. The central HMI package must include audible (buzzer/horn) and visual (strobe/beacon) alarm indicators for active generator/ATS fault conditions.

12 VDC/24 VDC