CSO FA700025SC001 Call 005 QnA 5 May 2026.pdf

CSO FA700025SC001 Call 005

Focused Area of Interest: USAFA AI High School Transcript Reading and Scoring Capability

Questions and Answers 5 May 2026

Q1: Are foreign IT companies allowed to team with us for a proposal on this program?

A1: No. In accordance with the DoD Cloud Computing Security Requirements Guide (SRG), foreign companies are not permitted to work with Controlled Unclassified Information (CUI), which includes the data processed by this system. All work must be performed by U.S. Citizens. (See clarification in A3 below).

Q2: Are there Security & Classification Restrictions pertaining to the handling of CUI that might prevent foreign IT company participation?

A2: Yes. The system will handle CUI (including PII/PHI). Per the most recent DoD Cloud

Computing SRG, systems processing CUI require U.S. Citizen personnel for development, administration, and access.

Q3: CLARIFICATION: Does the security requirement for this CUI data permit the use of Lawful

Permanent Residents (Green Card Holders), or is access strictly limited to U.S. Citizens?

A3: Clarification to A1 and A2: While foreign companies and foreign nationals are strictly prohibited, the government officially defines the personnel requirement for this effort as "U.S.

Persons." In accordance with Title 8 U.S.C. 1101(a)(20), a Lawful Permanent Resident (i.e., a "Green

Card holder") is legally considered a "U.S. Person." Therefore, U.S. Green Card holders are permitted to own the company, develop, and manage this program. Foreign Persons are not permitted to have access.

Q4: Will ITAR Certification of the foreign IT companies be required for this project?

A4: N/A. As stated above, foreign IT companies and foreign nationals are strictly prohibited from participating in this effort.

Q5: If using U.S. Persons (including Green Card holders), are there any additional company security requirements or special authorizations needed to participate?

A5: No special authorizations are required beyond meeting the requirements stated in the Call document. Standard security and personnel vetting protocols for CUI access will apply.

Q6: Is developing and hosting the software strictly within the U.S. sufficient to meet security protection requirements?

A6: No. While U.S.-based development and hosting (with no foreign sharing) is a firm requirement, the contractor's solution must also meet industry standards for the protection of

Personally Identifiable Information (PII) and all necessary security controls for the specified environment (Impact Level 4 is preferred).

Q7: Will the Government own the Intellectual Property (IP) rights to the underlying AI software, or will the contractor retain the right to resell their product?

A7: The Government will retain unlimited rights to all Government data, including but not limited to transcripts and any data extracted from them. In accordance with standard commercial practice for this acquisition, the contractor will retain the commercial rights to their underlying proprietary software and is permitted to resell their product.

Q8: Is USAFA intending that the respondent have an out-of-the-box model already trained through other company contracts, or is USAFA willing to provide transcript data to train a bespoke model specific only to the USAFA requirement?

A8: The Government expects the vendor to utilize a pre-existing, trained model. USAFA will not provide transcript data for the purpose of training a bespoke model, as previous applicants have not provided the necessary legal release for such use of their data.