RFI Industry Questions and Government Answers-5-21-26.xlsx
XLSX spreadsheet 27 KB Posted
- Solicitation number
- FA564126RXXXX
About this file
This file is a Questions and Answers document from the RFI Industry Questions and Government Answers for the USAFE-AFAFRICA/A6 Risk Management Framework (RMF) Process Efficiencies initiative. The document compiles written questions submitted by industry and corresponding government responses to clarify requirements and expectations for white paper submissions. The Q&A format serves to address common industry inquiries regarding the scope, technical requirements, evaluation criteria, and submission procedures for the RFI process.
The specific content and detailed Q&A pairs within the document are not fully visible in the provided excerpt, but the document functions as clarifying guidance for potential respondents preparing white papers due by 27 May 2026, 1400 CEST. Interested parties should direct submissions to Mr. Corey Chopko, Ms. Ina Hemmer, and Captain Kevin Sheedy at the provided Air Force email addresses. The government is seeking commercial solutions, particularly automation and AI-driven technologies that improve the RMF process while maintaining compliance with NIST SP 800-53 Revision 5 and DoDI 8510.01. This RFI is issued by the 764th ESS Contracting Squadron for market research and planning purposes only and does not constitute a commitment to award a contract or obligate government expenditures.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| A655 RMF Area of Interest - RFI - 1 May 26.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1 RFI USAFE-AFAFRICA/A6 - Risk Management Framework (RMF) Process Efficiencies
| Question # | Question | Answer |
| 1 | Step 4 Bottlenecks: Has the command considered how automated evidence collection and telemetry-driven configuration checks could specifically help hit the target of reducing the SCA timeline from 90 to 45 days? | As this is a RFI, the Government is in the early stages of market research and is considering a wide spectrum of approaches to meet its goals. No specific methodology, framework, technical standard, or solution at this time has been determined. Rather we encourage industry to propose innovative solutions, tools, and best practices, including, but not limited to, those referrenced here, that could help us achieve our objective. All input received will be used to inform future planning, requirements considerations, and acquisition strategy. |
| 2 | OSCAL & Machine-Readable Data: Is there an interest in transitioning from static documents to machine-readable artifacts using OSCAL to streamline compliance verification? | Response would be the same as the one provided above. |
| 3 | Facility Clearance and classified scope at the white paper stage. Section 4.0 indicates the eventual scope spans unclassified, SECRET, and SECRET//REL systems, and Section 5.0 lists "novel commercial solutions" as a required attribute. Will the Government consider a phased solution that demonstrates full RMF compression on unclassified systems initially, with classified scope addressed via teaming or facility clearance sponsorship at the contract stage? In other words, is an active Facility Clearance required at the white paper response, or only at the eventual award? | The Government would allow a phased approach in the event of a contract award, but all phases would need to be completed and solutions fully implemented within 1 year of contract award. An active Facility Clearance is not required for a white paper response, only if the contract is awarded. |
| 4 | Acquisition pathway confirmation. Section 3.0 indicates the Government is "considering a layered acquisition approach to utilize Commercial Solutions Opening (CSO)." Has CSO been confirmed as the planned pathway, or are FAR-based contracts, OTAs, or SBIR/STTR also under active consideration? This affects how we structure the recommended acquisition approach in Section 6. | The Government is considering all avenues to best execute this requirement to best support our mission partner. A CSO is considered as a potential pathway (as well as OTAs), but this is not confirmed we are keeping all potential options available to best support this requirement. |
| 5 | Approved AI tooling for the demo phase. For USAFE-AFAFRICA's environment, are there current restrictions on commercially available large language models (e.g., Claude, GPT-4, Gemini) for an unclassified prototype demonstration, or will tooling approval be addressed during contract execution? This affects whether our proposed solution leans on commercial APIs or on ATO'd alternatives such as Microsoft Azure OpenAI Service or AWS Bedrock GovCloud. | The Government will consider all prototypes for the White Paper submission. However, if the AI tool is required to be on AFNet and/or AFNet-S to be most effective, the Government requires the vendor to secure the ATO. |
| 6 | The RFI references "720 baseline controls" that must be analyzed. Are there existing templates, overlays, or tailoring decisions already approved by the AODR that vendors should incorporate, or is the expectation that the vendor will develop these from scratch? | DAF CISO developed the 720 and they deployed an Overlay in eMASS to apply them to all systems. No analysis currently needed. |
| 7 | If a cloud-based solution is proposed at a DoD IL4 or IL5 level, will the government sponsor or support a FedRAMP/DoD PA authorization process, or must the vendor arrive with a fully authorized offering? | Since U-A's boundary has systems classified at the SECRET and SECRET//REL levels, cloud-based solutions must meet IL6 security meaures. |
| 8 | The government states it will provide "reasonable time" for vendor access to U-A RMF personnel. Can the government quantify this e.g., estimated hours per week, number of SMEs available, and whether access would be in-person (USAFE locations in Europe) or remote? | Should the Government choose to move to a 365-day contract, the term "reasonable time" will be negotiatied. Based on current operations, the Government cannot dedicate one or more people for 40 hours a week to assist, however, the Government acknowledges it will play an active role for the vendor to develop solutions. Access to USAFE personnel should be in-person to the maximum extent possible, but remote work in CONUS is acceptable so long as 100% of the work isn't remote. |
| 9 | Is the government's intent to award a single contract to one vendor, or is a multiple-award or phased down-select approach (e.g., Phase 1 white paper → Phase 2 demonstration → award) being considered? | We are still evaluating acqusition strategies based on market research and industry feedback. We welcome industry's input on potential considerations. |
| 10 | Is there an anticipated period of performance beyond the 12-month implementation window for sustainment, O&M, or follow-on capability development? If so, what is the anticipated total contract term? | Currently, the Government does not expect a period of performance beyond the 12-month implementation window. |
| 11 | Does any aspect of this effort — including the systems within the U-A AO boundary, associated RMF artifacts, or data vendors would access during performance, involve technology or technical data subject to International Traffic in Arms Regulations (ITAR)? | The International Traffic in Arms Regulations are applicable. Any technical data shared with Foreign Partners must be approved by the FDO, and any technology proposed by the vendor and acquired by the Government (i.e. equipment or materials) needs an ITAR exemption for shipment to Ramstein. |
| 12 | To support accurate ROM pricing, requests that the Government provide: (1) the total number of systems currently in the U-A AO boundary, including the 17 approved systems and three systems in progress, and any anticipated additions during the 12-month implementation window; (2) a general characterization of representative system complexity, including number of applicable controls, hosting environment, classification level, and system type (kinetic, non-kinetic, COTS, GOTS); and (3) whether SECRET//REL systems require FORGE support within the 12-month period or whether SECRET is the maximum initial classification level. This information will allow us to provide a ROM that accurately reflects actual scope and avoids both under-pricing and over-pricing relative to the Government’s need. | There are currently 17 approved systems in the U-A AO boundary. The three systems that are in progress may be added during the 12-month implementation window, but it all depends on if the Information System Owner's team navigates the RMF process efficiently. The Government will not list the names of the systems, descriptions, or hardware/software attributes of each system for this RFI. However, the Government will say that it's a mix of COTS and GOTS, and that each system has to have the baseline 720 controls (DAF CIO mandate). Should the Government decide to let a 365-day contract, the vendor will have access to more detailed information about the systems. The ROM should include the 12 months PoP. Industry is welcome to include additional ROM information for the Government's planning purposes, but we request this clearly be broken out from the desired PoP of this effort. |
| 13 | Place of performance. Will the eventual contract require on-site presence at Ramstein, Sembach, or another USAFE-AFAFRICA location, or can the work be performed primarily from the Continental United States (CONUS) with periodic in-theater visits for workshops and demonstrations? | Access to USAFE personnel should be in-person to the maximum extent possible, but work can also be performed from CONUS. Addionally, the Government can provide a secure work area on Ramstein AB for the vendor to handle classified information. Lastly, the Government welcomes in-person engagements, observations, progress demos, etc. |
| 14 | Clearance level for vendor personnel. What clearance level (Public Trust, Secret, Top Secret, TS/SCI) does the Government anticipate requiring for vendor personnel on the eventual contract? | The Government expects vendor personnel to have a clearance level access data that is classified at most SECRET//NOFORN. |
| 15 | Platform hosting model. For solutions that include a software platform, does the Government prefer (a) vendor-hosted Software-as-a-Service (SaaS) with appropriate FedRAMP or DoD Impact Level authorization, (b) Government-owned and Government-operated (GOGO) deployment inside a USAFE-AFAFRICA enclave, (c) Government-owned and Contractor-operated (GOCO), or (d) vendor recommendation? | Government owned and contractor operated is preferred. The USAFE Boundary systems are mostly classified and most are stand alone or closed restricted. Vendor hosted could impose constraints or complications. Government hosted would probably be easier to overcome any "connections" to the supported systems. Contractor operated needs to include cradle to grave RMF/Cybersecurity performed on-site. Information System Owner (ISO) and Program Manager roles should be government (A6) but Information System Security Manager (ISSM), Engineer (ISSE), Officer (ISSO), System/Network Admins (SA/NA) would be contractor roles. |
| 16 | Reciprocity for commercial tools. Will the Government accept reciprocity from existing FedRAMP Moderate, FedRAMP High, or DoD Impact Level (IL2/IL4/IL5) authorizations for commercial RMF tooling, or will a new Authorization to Operate (ATO) be required for any tool deployed into the USAFE-AFAFRICA boundary? | Reciprocity is encouraged, so long as the vendor knows that approval is not guaranteed--rather, it's contingent on the U-A AO accepting what another AO approved. Should the vendor propose a solution that already has an ATO or IATT from another DoW organization, the Government asks that the vendor proivde all artifacts required for consideration (e.g. SAR, POAM, diagrams, etc) as well as the system's eMASS number. |
| 17 | Existing tools and integrations. Are there existing RMF tools, governance, risk, and compliance (GRC) systems, or workflow platforms (for example, eMASS, Xacta, RSA Archer, ServiceNow GRC) currently in use at USAFE-AFAFRICA that any new solution must integrate with, replace, or remain compatible with? | Currently, eMASS is the only workflow platform required by SAF/CN, so eMASS is the only platform USAFE uses for systems classified as SECRET or UNCLASSIFIED. |
| 18 | Pilot scope. Approximately how many systems does the Government anticipate including in the initial pilot? Will the pilot include UNCLASSIFIED, SECRET, and SECRET//REL systems from the start, or phase them in over the 12-month implementation window? | The Government would allow a phased approach in the event of a contract award, but all phases would need to be completed and solutions fully implemented within 1 year of contract award. An active Facility Clearance is not required for a white paper response, only if the contract is awarded. The USAFE Boundary currenlty has approximatly 20 systems. The classification of each varies between Unclass, Secret, and Secret/Rel. |
| 19 | Acquisition timeline. What is the Government's anticipated timeline between RFI close and the issuance of a follow-on solicitation (whether RFP, RFQ, or CSO Solutions Brief), and the anticipated contract start date? This helps vendors plan for cleared personnel availability and platform deployment lead times. | Plans will be discussed after evaluating the RFI responses. The Government is motivated to move quickly on this effort, but we hope to share potential milestone updates with either future industry engagements or draft solicitation documents |
| 20 | CSO pathway. If the Government proceeds with a Commercial Solutions Opening, is the CSO expected to be issued through an existing pathway or consortium (for example, AFWERX, Tradewinds, DIU, SOFWERX), or as a stand-alone CSO administered by the 764 ESS? | Either options are potential pathways. We welcome industry to provide their own recommendations on vehicles that are available as well as those the 764 ESS can execute |
| 21 | CSRMC alignment. The RFI references DoDI 8510.01 and NIST SP 800-53 Revision 5 as the compliance frameworks. We note that the Department of War announced the Cybersecurity Risk Management Construct (CSRMC) on 24 September 2025 as a successor to the legacy Risk Management Framework. To ensure the proposed solution is forwardcompatible, can the Government clarify (a) the anticipated timeline for CSRMC adoption at USAFE-AFAFRICA, and (b) whether the solution should be evaluated against current RMF only, current RMF with explicit CSRMC migration architecture, or both? | We currently have no data on if/how DoW plans to implement CSRMC. We are currently using RMF Rev 5 and anticipate doing so until DoW or DAF releases a different methodology. |
| 22 | 720-baseline control list access. The RFI references "720 baseline controls" mandated by SAF/CN for new or renewed ATO. To ensure our standardization analysis maps accurately to the actual baseline, can the Government confirm whether (a) the 720-control list is publicly available, (b) the list is releasable to interested parties under this RFI for white papaer preparation, or (c) the list will be made available to the awarded vendor under appropriate access controls? | The Government is unable to provide those 720 baseline controls at this time. However, should the Government choose to let a 365-day contract, the Government will then provide access to and information about those 720 baseline controls, as well as any additional overlay controls required for certain types of systems (ex. cross domain solutions). |
| 23 | Pilot system selection authority. Section 4 of the RFI describes a 12-month implementation expectation. For pilot system selection during the implementation period, will the awarded vendor (a) propose pilot systems for AODR approval, (b) be assigned pilot systems by AODR, or (c) collaborate with AODR on selection? Additionally, will the pilot system selection prioritize coverage across system types (kinetic, non-kinetic, COTS, GOTS) per the RFI's adaptability requirement? | Should the Government choose to move to a 365-day contract, the awarded vendor will have access to one each UNCLASSIFIED, SECRET, and SECRET//REL system that could be either/or COTS/GOTS and kinetic/non-kinetic. However, the solutions provided by the vendor should cover all types of systems below TOP SECRET. Additionally, U-A's AODR will recommend systems for a pilot, but the Government would like to collaborate on potential solutions. |
| 24 | Demonstration format preference. Section 6 of the RFI requests a brief description of how the vendor would conduct a live technical demonstration. Does the Government have a preference for (a) in-person demonstration at 764 ESS Kaiserslautern or other USAFE location, (b) virtual demonstration via DoD-approved secure video conferencing, or (c) hybrid? If in-person, are there preferred installations or facilities? | The Government would allow industry maximum flexibility and has no preference. |
| 25 | eMASS integration scope expectations. The RFI describes integration with existing RMF tooling implicitly through references to AODR/SCA workflows. Does the Government have preferences regarding (a) integration depth with eMASS (read-only ingestion, bidirectional sync, full eMASS replacement), and (b) any other tools currently in use at USAFE-AFAFRICA (e.g., Telos Xacta, RegScale, or USAFE-specific tooling) that the proposed solution should interoperate with? | Since U-A's boundary has systems classified at the SECRET and below levels, and eMASS is the DAF CIO-mandated platform, no other RMF tooling will be considered. However, if pilots were successful, the Government would be open to requesting APIs to allow bidirectional sync if DISA/DAF allows. |
| 26 | Classification environment for pilot systems. The RFI references unclassified, SECRET, and SECRET//REL systems as in-scope. For pilot work in classified environments, will the Government provide (a) appropriate facility access (SCIF, secure work area), (b) classified-network workstation access, and (c) personnel security clearance sponsorship support if reactivation is required? UT's principal holds an inactive but reinstateable TS/SCI clearance (held continuously 2015 through July 2025). | Access to SCIF space is not needed, but the Government will provice a secure work area and access to AFNET-S workstations. The Government will sponsor security clearances, so long as acquiring a security clearnance does not negatively impact contract execution, should a contract be let. |
| 27 | Operating environment for AI components. Given DoD's evolving guidance on AI vendor authorizations (including the ongoing Anthropic litigation, expedited oral arguments scheduled 19 May 2026 in N.D. Cal.), can the Government provide guidance on (a) approved AI model providers for SECRET / SECRET//REL workloads at USAFE-AFAFRICA, and (b) any restrictions on commercial cloud deployment substrates (e.g., AWS Bedrock GovCloud, Azure Government, Oracle Government Cloud)? Our architecture is model-portable; this clarification ensures our white paper addresses the correct deployment substrate. | Since U-A's boundary has systems classified at the SECRET and SECRET//REL levels, so cloud-based solutions must meet IL6 security meaures. |
| 28 | Acquisition pathway confirmation. The RFI Section 3.0 indicates the Government is considering Commercial Solutions Opening (CSO) under DFARS Subpart 212.70. Can the Government confirm (a) whether CSO is the leading candidate pathway, (b) anticipated solicitation timeline if CSO is selected, and (c) whether the awarded contract structure would be Other Transaction Agreement under 10 U.S.C. § 4022 or alternative CSO instrument? | The Government is considering all avenues to best execute this requirement as quickly a CSO as a potential pathway (as well as OTAs), but we are keeping all potential options available to best support this requirement. Therefore, we do not have a set acquisition strategy at this time. Market research will aid in shaping our acquisition approach. |
| 29 | Government-furnished generative AI (post-NIPRGPT) coexistence. The Department of the Air Force sunset NIPRGPT effective 31 December 2025 and redirected users to GenAI.mil and "other approved systems." To ensure UT's solution architecture accommodates the Government's current generative-AI tooling landscape rather than competing with it, can the Government clarify (a) whether GenAI.mil (or any other Government-furnished generative-AI capability) is in operational use at USAFE-AFAFRICA today for any unclassified or classified scope, (b) any directional preferences regarding the use of Government-furnished generative AI versus commercial-vendor-provided generative AI for the proposed RMF solution, and (c) whether the awarded vendor's solution is expected to interoperate with GenAI.mil or peer Government-furnished tooling (e.g., as an upstream input source for analyst chat workflows or a downstream artifact consumer for RMF authorization packages)? | Currently, GenAI is available for use for all USAFE-AFAFRICA personnel with AFNet access, while Grok and ChatCPT are in the works by the Department of War. The Governmant requests further clarification on the question regarding part c as the RFI does not identify this expectation |
| 30 | eMASS REST API access provisioning. The proposed solution architecture depends on programmatic eMASS integration via the DISA eMASS REST API for OSCAL artifact ingestion and emission, as well as for SCAR/POA&M lifecycle management. Can the Government clarify (a) whether DISA eMASS REST API access is provisioned for the awarded vendor as part of contract execution, (b) any specific access requirements at the vendor entity or principal level (e.g., DoD-issued PKI certificate, IL2 / IL4 / IL5 deployment substrate registration, vendor-entity ATO prerequisite), and (c) any USAFE-AFAFRICAspecific integration patterns or constraints (e.g., separate eMASS instances per AOR or classification level) that should shape the integration design? | The Government currently has no API access as there has been no requirements to have it up to this point. SAF/CN is the sole approval for all eMASS API access, but current guidance from them is that new access requests are on hold. |
| 31 | Incumbent solutions and prior pilot lessons. The RFI invites market research on RMF process efficiencies. Can the Government clarify (a) whether USAFE-AFAFRICA currently has an incumbent vendor or DoD-authorized commercial solution providing automated RMF artifact authoring (CIS, SCAR, POA&M generation) at the office in any scope, (b) whether the proposed engagement is intended to supplement, replace, or coexist with any incumbent capability, and (c) any operational lessons learned from prior RMF-automation pilots or proofs-of-concept (whether at USAFE-AFAFRICA or peer DAF offices) that should inform the proposed solution's architecture or scope boundaries? | The Government does not have an incumbent vendor that is automating RMF artifact authoring, but does have an incumbent vendor serving as Security Control Assessor Representatives that audit the artifacts provided by the Information System Owner teams. The Government acknowledges that the proposed engagement could supplement, replace, and/or coexist with any incumbent capability. There exists no prior RMF automation pilots, so there are no lessons learned. |
| 32 | The RFI requires an ATO, IATT, or Common Criteria certification, but states noncompliant technology "will be addressed on a case-by-case basis." What is the evaluation criteria for case-by-case exceptions, and will vendors without current DoD ATO be disqualified at the white paper stage or only at solicitation? | The Government is ready to evaluate all proposed solutions. However, should the Government choose to move to a 365-day contract, if vendor's proposed tool is required to be on AFNet and/or AFNet-S to be most effective, the Government requires the vendor to secure the ATO and fully implement the solution w/in 365 days. |
| 33 | Does USAFE-AFAFRICA/A6 require the solution to operate within a USAFE-specific boundary, or will a DISA-issued enterprise ATO (e.g., IL4) satisfy the requirement for SECRET and SECRET//REL systems? | A DISA-issued enterprise ATO is highly encouraged, so long as the vendor understands that reciprocity is not guaranteed--rather, it's contingent on the U-A AO accepting what another AO approved. Additionally, since U-A's boundary has systems classified at the SECRET and SECRET//REL levels, so cloud-based solutions must meet IL6 security meaures. Should the vendor propose a solution that already has an ATO or IATT from another DoW organization, the Government asks that the vendor proivde all artifacts required for consideration (e.g. SAR, POAM, diagrams, etc) as well as the system's eMASS number. |
| 34 | SECRET//REL systems are included in scope — does this imply IL5 is required, or will IL4 suffice given the REL designation is for NATO partners? | Since U-A's boundary has systems classified at the SECRET and SECRET//REL levels, cloud-based solutions must meet IL6 security meaures. |
| 35 | The RFI references eMASS as the system of record for RMF documentation. Is full eMASS replacement in scope, or must the solution integrate with and feed eMASS as the authoritative ATO repository? | Full eMASS replacement is out of scope. |
| 36 | Are the 17 currently authorized systems expected to be retroactively onboarded during the 12-month period, or does the solution only need to support new/renewal ATO actions going forward? | The 17 currently authorized systems are already onboarded, so the vendor's solution only needs to support new/reneal of ATOs. |
| 37 | Does USAFE-AFAFRICA/A6 currently use ACAS/Nessus for vulnerability scanning, and will vendors have access to sample SCAP/STIG outputs during the demonstration phase? | Yes to both upon contract award. |
| 38 | Will the Government conduct oral presentations or technical demonstrations as part of the white paper evaluation, or only after a down-select to a solicitation? | While this is considered, the structure of the solicitation and acquistion strategy is not yet determined. After market research we will evaluate how best to proceed forward. |
| 39 | If a CSO is executed, what OTA consortium memberships does USAFE-AFAFRICA/A6 /764 ESS currently recognize as eligible vehicles? | At this time this hasn't been determined. A CSO and potentially OTA are considered. We welcome industry to provide us with potential vehicles that the AF contracting officers, like the those within the 764th, could leverage as well as other contracting offices that would have the potential to support A6's requirement. |
| 40 | Is there a preferred period of performance structure (base + options), and does the ROM estimate need to reflect the full 12-month implementation or include a sustainment tail? | The ROM should include the 12 months PoP. Industry is welcome to include additional ROM information for the Government's planning purposes, but we request this clearly be broken out from the desired PoP of this effort. |
| 41 | Does the Government anticipate that the desired solution will be delivered primarily as software, services, or a hybrid software-enabled services solution? | The government anticipates the solution to propose efficiencies gained by technological and non-tech solutions or a combination of the two. |
| 42 | Should respondents assume the future solution must operate inside a Governmentcontrolled environment, vendor-hosted environment, cloud environment, on-premises environment, or multiple deployment models? | The Government expects the solution to operate in a Gov't controlled environment, cloud environment, and/or on premise, but not vendor-hosted. |
| 43 | If cloud deployment is acceptable, does the Government require FedRAMP authorization, DoD Impact Level hosting, or another specific authorization baseline at the time of response, pilot, or production deployment? | Since U-A's boundary has systems classified at the SECRET and SECRET//REL levels, cloud-based solutions must meet IL6 security meaures. |
| 44 | Does the Government anticipate that the solution will process CUI, classified information, SECRET, SECRET//REL, or only synthetic/dummy data during demonstration and pilot phases? | The Government will provide representative data from the actual systems to be used during the demonstration phase. |
| 45 | Does the Government intend for the solution to integrate with existing RMF, eMASS, Xacta, ServiceNow, Jira, document management, vulnerability management, or other workflow systems currently used by USAFE-AFAFRICA/A6? | Yes, any systems that's currently used to SECRET//NOFORN and below. |
| 46 | Are there incumbent RMF workflow tools, GRC platforms, or automation tools currently supporting the AODR/SCA process that respondents should assume will remain in place? | The Government does not have an incumbent vendor that is automating RMF artifact authoring, but does have an incumbent vendor serving as Security Control Assessor Representatives that audit the artifacts provided by the Information System Owner teams. The Government acknowledges that the proposed engagement could supplement, replace, and/or coexist with any incumbent capability. There exists no prior RMF automation pilots, so there are no lessons learned. |
| 47 | For the requirement to address all six RMF steps, does the Government expect equal depth across all steps, or should respondents prioritize measurable acceleration of Step 4 while showing end-to-end process coverage? | The Government expects all steps to be addressed and acknowledges that efficiences might be more significant in some steps over others. |
| 48 | For the objective to reduce RMF Step 4 from 90 days to no more than 45 days, what activities does the Government include within the current 90-day Step 4 timeline? | Generally speaking, Step 4 consists of the Security Control Assessor team reviewing all the artifacts provided by the Information System Owner team to evaluate whether the implementation of selected controls (Step 3) are functioning as intended and meet the security requirements of the system. Then, the SCA team writes a Security Assessment Report and builds the authorization decision brief for the Authorizing Official. |
| 49 | Should respondents assume the 720-control USAF baseline is fixed, or is the Government seeking recommendations for tailoring, inheritance, overlay use, templating, and standardization to reduce redundant assessment effort? | At this time, the Government expects the respondents to assume the 720 controls are fixed. However, the Government will entertain fact-based recommendations pertaining to a reduction in the number of baseline controls. Caveat: Currently, reducing the number of controls is not within USAFE's authority, and would require the DAF CIO approval. Additionally, more controls may be addeded due to overlays depending on the type of system (NSS, Privacy, CDS, etc.). Those additional controls CAN be tailored (if appropriate). |
| 50 | Should AI-assisted outputs be treated as advisory to Government personnel, or does the Government envision any automated decision-support capability for SCAR/SCA recommendation development? | The Government expects AI-assisted outputs be treated as advisory to allow the SCA to make the overall recommendation to the AO. |
| 51 | What level of explainability, audit logging, source citation, or human-in-the-loop review does the Government expect for AI-assisted RMF outputs? | All output must be verified by the human in order for accurate risk recommendations to be given to the AO. |
| 52 | What Government personnel, data access, system access, or subject-matter expert availability should respondents assume for a 12-month implementation roadmap? | Since U-A's boundary has systems classified at the SECRET and SECRET//REL levels, cloud-based solutions must meet IL6 security meaures. |
| 53 | Does the Government anticipate a pilot or phased implementation before full deployment, and if so, how many systems should respondents assume for an initial pilot? | The Government would allow a phased approach in the event of a contract award, but all phases would need to be completed and UNCLASSIFIED, SECRET, and SECRET//REL solutions fully implemented within 1 year of contract award. Access to 1 representative system per classifiication will be facilitated by the Government. |
| 54 | Does the Government prefer that respondents recommend an acquisition pathway, such as FAR-based procurement, CSO, OTA, SBIR/STTR, GSA MAS, or another vehicle? | Yes the Government requests industry provide their perspective on potential pathways for execution and vehicles that enable contracting to execute quickly |
| 55 | Will small business status, HUBZone status, or other socioeconomic status be considered in any future acquisition strategy? | Small businesses are welcome and encouraged to respond and provide inputs, however, OCONUS contracting does not require application of FAR Part 19. |
| 56 | Does the Government intend to evaluate responses based on technical maturity, implementation feasibility, authorization posture, cost realism, past performance, or another set of criteria? | This has not been determined at this time. |
| 57 | Should ROM pricing be provided as a total 12-month implementation estimate, phased pilot-to-production estimate, license/subscription model, labor-based model, or multiple pricing options? | A ROM should demonstrate how the vendor would achieve full implementation in 12 months, and the Government is open to multiple pricing options. That said, the Government would like to see how the vendor estimates the phases to occur (pilot-to-production), any estimated up-front costs for software/hardware, and what it would costs to sustain that hardware/software. |
| 58 | Are subcontractors or technology partners permitted or encouraged where they strengthen authorization posture, hosting maturity, or specialized RMF automation capability? | This is left to industry to determine how they plan to structure their business arrangements to meet this requirement |
| 59 | Is the Government willing to consider solutions that do not currently possess an ATO, IATT, Common Criteria certification, FedRAMP authorization, or DoD Impact Level authorization if the respondent proposes a Government-enclave, on-premises, offline, or controlled pilot deployment model? | On a case by case basis, the Government is willing to consider solutions that currently do not possess an ATO, IATT, Common Criteria certification, etc. However, the vendor must acknowledge that if the proposed solution requires connection to one of U-A's warfighting system, an Authorization to Connect will be needed, and the Government will ask for detailed specification about the proposed solution. |
| 60 | For supply-chain risk, are there specific restrictions or expectations regarding AI models, open-source components, foreign ownership/control/influence, data residency, or software bill of materials? | The Contractor shall ensure they follow current guidance and regulations to comply with all applicable AF and DoW guidance relating to Supply Chain Risk Management. For example, the DoD Supply Chain Risk Management Guidebook (2025), para 4.1, which references DoDI 8510.01 Risk Management Framework for DoD Systems. |
| 61 | Please clarify what the Government means by “all 720 baseline controls.” Should vendors assume a specific CNSSI 1253 baseline, USAF overlay, or USAFE-AFAFRICA-definedcontrol set? | DAF CISO developed the 720 and they deployed an Overlay in eMASS to apply them to all systems. Additional controls may apply depending on Step 1 Categorizagion (e.g. Privacy, NSS, CDS, etc. in scope). |
| 62 | For proposed software applications or enabling tools, will USAFE-AFAFRICA accept authorization reciprocity from other DoD organizations? If so, what documentation would be required for reciprocity review? | Reciprocity is encouraged, so long as the vendor knows that approval is not guaranteed--rather, it's contingent on the U-A AO accepting what another AO approved. Should the vendor propose a solution that already has an ATO or IATT from another DoW organization, the Government asks that the vendor proivde all artifacts required for consideration (e.g. SAR, POAM, diagrams, etc) as well as the system's eMASS number. |
| 63 | What restrictions apply to the use of AI or machine learning for RMF artifact review or related RMF support activities? | The Government doesn’t understand what restrictions might apply and would request vendors identify potential restrictions in their RFI responses as clarifications or further information for consideration in the potential solicitation and/or industry engagement. |
| 64 | For the live technical demonstration, will the Government provide representative synthetic RMF artifacts, or should vendors generate their own synthetic data set? | The Government will provide representative data from the actual systems to be used during the demonstration phase. |
| 65 | How many systems does the Government anticipate including in the initial pathfinder or pilot? | For the initial pathfinder, the Government anticipates including one UNCLASSIFIED and one SECRET system in order to demonstrate the ability to properly work with classified data. |
| 66 | What does the Government specifically consider to be “fully implemented within 12 months”? | Should the Government choose to let a 365-day contract, full implementation means the following: any process changes proposed by the vendor and agreed to by the Government must be implemented and followed by the ISO's team and SCA team; any technology proposed by the vendor and accepted by the Government must have an authority to operate, the users must be fully trained, and the system fully operational. |
| 67 | Does the Government have a preferred output file format for proposed solutions to support Step 4 SCAR/SCA review? | All formats must support importing directly to eMASS without manual correction or manipulation. Typically .CSV, .NESSUS, ASR/ARF, clk, .xccdf, and .cklb are used, but don't assume that's all. |
File details come from the government source that posted it. Updated .