Call 0008_AI-ESOC_Final.pdf

16th AIR FORCE

COMMERCIAL SOLUTIONS OPENING – CALL 0008

FA7037-23-S-C0001

TOPIC: 007, AIR FORCE INFORMATION NETWORK (AFIN)

TOPIC: 016, DEFENSE CYBERSPACE OPERATIONS (DCO) & DEFENSE

CYBERSPACE OPERATIONS-INTERNAL DEFENSE MEASURES (DCO-IDM)

AI-ENABLED ENTERPRISE SECURITY OPERATIONS CENTER (AI-ESOC)

Table of Contents

1. INTRODUCTION AND BACKGROUND

2. PURPOSE

3. CSO CALL APPROACH AND OVERVIEW

4. GENERAL INFORMATION

5. SUBMISSION INFORMATION

1. INTRODUCTION AND BACKGROUND

1.1 The 16th Air Force (Air Forces Cyber), through the 688th Cyberspace Wing (CW) is responsible for the operation, availability, and defense of the Department of Air Force's

Information Network (DAFIN). The 688 CW owns the DAFIN Security Operations

Center (SOC), which monitors the Department of the Air Force Information Network

(DAFIN) for over one million global users.

1.2 The DAFIN SOC is responsible for securing and defending the DAFIN. The DAFIN

SOC provides real-time protection, detection and response of the AF enterprise against cyber threats. This is done by alerting behaviorally complex activities, conducting threat hunts, investigating alerts across disparate data sources and reporting results to

HHQs.

1.3 The Air Force requires a solution that provides on-site systems integration, deployment, and sustainment support that can integrate AI-enabled capabilities into the DAFIN enterprise environment which will enable autonomous data correlation, apply behavioral analytics to detect malicious activity and provide autonomous tasking and reporting.

1.4 The 688 CW is looking for new and innovative approaches and capabilities, including rapid and secure AI agent development and deployment to transform enterprise workflows. The resultant contract from this CSO Call will establish a pilot program and will serve as the initial blueprint for enterprise SOC AI transformation. The idea is to leverage mature technologies to transform DAFIN SOC operations by focusing on the three topic areas listed below:

1.4.1 Agentic Behavioral Analytics and Threat Detection Platform

1.4.2 Autonomous SOC Investigation and Tasking Execution Platform

1.4.3 Systems Integration, On-Site Deployment, and Sustainment

2. PURPOSE

2.1 This Commercial Solutions Opening (CSO) Call, in accordance with 10 USC 3458, Revolutionary FAR Overhaul (RFO) 6.101 and R-DFARS 212.70 Defense Commercial

Solutions Opening, is a competitive solicitation seeking an integrated commercial solution to transform enterprise SOC operations at the 33rd Cyberspace Operations

Squadron through an initial pilot. The 16th Air Force seeks the best available approaches to meet the capability objectives described herein.

2.2 "Innovative" means any technology, process, or method, including research and development, that is new as of the date of proposal submission, or any new application of an existing technology, process, or method as of that date.

2.3 The Government anticipates a single award under this CSO for an integrated solution encompassing all capability areas described in Attachment 6.

3. CSO CALL APPROACH AND OVERVIEW

3.1 This CSO Call seeks the best commercial approaches to meet various technology objectives of 16th Air Force. All items, technologies, and services acquired using a

CSO Call will be treated as commercial items. The Government encourages proposals that span a wide spectrum of possible technical and business solutions in response to the specific technology topics stated in Attachment 6. The Government reserves the right to award funding to any combination of proposals which offer the best overall value to the Government, and to oversee any and all processes and approaches once initiated. Awards of efforts as a result of this announcement will be in the form of contracts or other transactions (OT) as codified in 10 U.S.C. §2371b

(section 2371b).

3.2 Funding for participation in this program is highly competitive and the price of proposed technologies should be considered. Awards resulting from this CSO Call will be made based on the evaluation results of a two-stepped proposal process described in Section 5. The Government reserves the right to fund all, some, one, or none of the proposals submitted; may elect to fund only part of a submitted proposal;

and may incrementally fund any or all awards under this CSO Call. All awards are subject to the availability of funds.

3.3 All coordination and communication between Offerors and the Government will be conducted using the Sam.Gov website and the points of contact associated with this

CSO Call, as specified in Section 4.

3.4 Note: Do not include Proprietary, classified, confidential, or sensitive information in responses. The government intends to use contractor support personnel to intake and process whitepapers and proposals.

Whitepaper responses are not offers and cannot be accepted by the U.S. Government to form a binding contract or agreement. This notice shall not be construed as a commitment by the Government to issue a solicitation, or ultimately award a contract, nor does it restrict the Government to a particular acquisition approach.

The Government will in no way be bound to this information if any formal solicitation is issued. This request for whitepapers is issued solely for information and planning purposes and to identify interested sources. Further, unsolicited proposals will not be accepted. Funding is not available at this time. Release of this request for whitepapers should not be construed as such a commitment or as authorization to incur cost for which reimbursement would be required or sought.

Response to this CSO Call is voluntary and no reimbursement will be made for any costs associated with providing information in response to this and any follow-on information requests. All submissions become Government property and will not be returned.

4. GENERAL INFORMATION

4.1 POINT OF CONTACTS. Questions regarding the administrative content of this

CSO Call must be addressed to the Contracting Office below. Questions regarding the technical content of this CSO Call must be addressed to the Technical Point of

Contact (POC) below.

Contracting Office POC: Ms. Carissa Heuertz

Email: 16af.cso.workflow@us.af.mil

Technical POC: Maj Veronika Creavey

Email: 16af.cso.workflow@us.af.mil

4.2 CLASSIFIED INFORMATION. Classified information will not be accepted in response to this CSO Call.

5. SUBMISSION INFORMATION

5.1 SUBMISSION OVERVIEW. Step I submissions shall include both the Quad Charts and White Papers prepared in accordance with the formats at Attachments 1 and 2 respectively. Each company may submit one white paper and one quad chart for this

CSO Call. Submissions should address all TOPICS and all requirements outlined in

Attachment 6. Step I submissions can be submitted at any time prior to April 1, 2026 at 5:00 P.M. CST, but offerors are encouraged to monitor Sam.gov for any specific amendments to the CSO Call that may have updated information. The 16th

Air Force and 688 CW will invite select Offerors to submit full proposals based on favorable evaluation results of Step I submissions. Step II submissions will be requested ONLY by the Contracting Officer and will contain separate submission instructions and timelines within the Request for Proposal (RFP) letter.

5.2 TWO-STEP SUBMISSION. This CSO Call will be conducted in two steps as follows:

5.2.1 STEP I. Interested offerors must submit Quad Charts and White Papers in accordance with instructions provided in this CSO Call. Step I submissions will be evaluated against criteria as described in Attachment 7 of this CSO Call. Due to the requirements and scope of this CSO Call, submissions must be concise and informative. Content exceeding stated page limits will not be evaluated.

Submissions lacking technical depth, demonstrated DoW operational experience, or alignment with the 16th Air Force mission will be assessed accordingly.

5.2.1.1 All Quad Charts should include the information indicated on the sample template in Attachment 1.

mailto:16af.cso.workflow@us.af.mil

5.2.1.2 The White Paper expands upon the Quad Chart presentation, with format and content instructions detailed in Attachment 2. Each offeror's White Paper must include a Technology Readiness Level (TRL) assessment aligned to all technology objectives, projecting the expected TRL upon pilot completion. This assessment must conform to the DoW Technology Readiness Assessment Guidance.

Because this effort requires a field demonstration within the base period of performance, solutions must be at TRL 7 or higher at the time of submission.

5.2.1.3 White paper and quad chart submissions shall be sent to

16af.cso.workflow@us.af.mil for review and shall include in the subject line of email “Call 0008 AI-ESOC”.

5.2.2 Notification of Selection. All offerors providing Step I submissions will be contacted by the Government, either with an email letter informing them that the effort proposed is not of interest to the Government at this time or with a request for a formal price and technical proposal by a specific date.

5.2.3 STEP II. Step II proposals will only be accepted from Offerors who upon review of Step I submissions, are invited by the Contracting Officer to submit a full proposal. In order to be considered for award under Step II, offerors must be registered in the System for Award Management (SAM) at www.sam.gov, be considered responsible within the meaning of FAR Part 9.1, Responsible

Prospective Contractors, have a satisfactory performance record, and otherwise be eligible for award based on federal law and regulation.

Offerors must possess all required personnel security clearances, facility clearances, and other infrastructure necessary to perform any proposed work, without utilizing

Government resources.

5.2.3.1 Proposal Submission. Upon notification from the Contracting Officer, offerors have a specified number of calendar days to prepare and submit a proposal in accordance with the format and instructions at Attachments 3-5. Each proposal shall include a Statement of Work (SOW) and detailed pricing. All pages shall be numbered.

5.2.3.2 Proposal Review, Evaluation and Selection Process. Each proposal will be evaluated on its technical merit according to the criteria and process detailed in Attachment 7. Proposal selection will be primarily based on technical merit, demonstrated operational performance in DoW environments, importance to agency programs, and funding availability. Qualified Government personnel will conduct reviews and, if necessary, convene panels of experts for evaluation.

5.3 Rights in Technical Data, Computer Software and Computer Software Documentation.

Offerors must mark each page of their White Paper containing proprietary information.

The Government intends to acquire only the data necessary to meet agency needs.

Offerors may include instructions to restrict the use, release, or disclosure of data and http://www.sam.gov/ computer software documentation. These assertions are governed by DFARS clauses

252.227-7013, 7014, and 7017.

ATTACHMENT 1: QUAD CHART FORMAT

The following information must be included in the Step I Quad Chart. Quad Charts shall not exceed 1-page in landscape view. Quad Charts must follow the formatting guidelines on the slide template below.

ATTACHMENT 2: STEP I WHITE PAPER FORMAT

The White Paper narrative expands on the Quad Chart presentation, and must be 8.5 x 11 inches with one-inch margins, no longer than two pages, single-spaced, with text in Times New Roman, no smaller than 12 point font. All white papers must specify a project title, the Offeror’s organization, and the specific topic number associated with the proposal (see Attachment 6).

Pages in excess of the page limitation will not be read or evaluated. White Papers must not exceed a file size of 10 MB.

The White Paper must be limited only to further explanation of the information conveyed in the

Quad Chart, as deemed necessary by the Offeror. The information should provide sufficient information on the proposed solution to allow for an assessment by a technical expert.

Expand as deemed necessary on the following sections of the Quad Chart:

• Objective and integrated solution approach across all capability areas

• Description of the effort

• Benefits of the Proposed Technology

• Technical and integration challenges and proposed mitigations

• TRL at project start and planned TRL at project completion

• Prior operational performance and integration in federal security operations environments

• Major Goals/Milestones by Government fiscal year.

White paper and quad charts shall be sent to 16af.cso.workflow@us.af.mil for review.

ATTACHMENT 3: STEP II TECHNICAL PROPOSAL FORMAT

(DO NOT SUBMIT UNLESS INVITED BY CO IAW Section 5.2.3 above)

The Technical Proposal portion of the Step II submission shall not exceed 10 pages, excluding cover page and table of contents. Any pages submitted in excess of the 10-page limit will not be considered or evaluated.

Suggested page limitations for individual sections are listed below; however, these are guidelines not strict limits.

I. ABSTRACT. [1 page suggested.]

II. SCOPE. This proposal is submitted in response to the 16th Air Force Commercial

Solutions Opening (CSO) Call on….. [Cite the Project Title. 8 pages suggested.]

a. Objective. [A clear and concise description of the objective of the proposed project.]

b. Background. [Provide the necessary technical and scientific background to support the scientific and technical merits of the proposed project.]

c. Programmatics. This effort will support the 33rd COS initiative [topic number] aimed at developing [capability area or topic title] technologies or capabilities. [Describe the Offeror’s management plan for the proposed project; list supporting and collaborating organizations and subcontractors;

clearly identify roles and responsibilities of each organization and subcontractor supporting the project].

d. Relevance. [Describe the relevance of the proposed project in terms of mission, end-user needs and the technology maturity of the proposed project.]

III. CREDENTIALS. [Describe the Offeror’s qualifications to perform the proposed work across all capability areas. 2 pages suggested.]

IV. WORK TO BE PERFORMED. [Provide details of the work to be performed by task and subtask. 9 pages suggested.]

a. General. [Provide an overview.]

b. Detailed Tasks. [Describe the details of all tasks needed to perform the proposed work. Clearly distinguish base period tasks and option tasks as appropriate.]

V. PERFORMANCE SCHEDULE. [Depict the tasks and sub-tasks and the duration of performance of each in a Gantt chart or other suitable chart. Briefly describe the proposed period of performance. 2 pages suggested.]

VI. REFERENCES. [List any relevant documents used to develop the technical approach. 1 page suggested]

ATTACHMENT 4: STEP II PRICE PROPOSAL FORMAT

The price proposal must include pricing information sufficiently detailed for a meaningful evaluation. Since this CSO Call is limited to commercial solutions, detailed cost breakdowns are not required. However, the offeror must provide sufficient supporting data for the

Contracting Officer to determine price reasonableness. The offeror bears the burden of establishing price reasonableness.

The Offeror shall prepare the Price Proposal (with the exception of the narrative information described below) using Microsoft Excel format, but shall merge all Price Proposal documents into one Adobe PDF file for ultimate proposal submission. Include the Topic Number and the Project Title on all pages. Retain the Excel version for subsequent Government request.

Format requirements:

• Paper Size – 8.5 X 11-inch paper

• Margins 1-inch

• Spacing – single

• Font – Times New Roman, 12 Point

Cover sheet attached to the price proposal shall include:

• Full company name and address of Prime Contractor

• CSO Call number and Title

• Point of contact, name, title, and phone number

• CAGE code

• Unique Entity Identifier (UEI)

• Identification of any Government property required for performance

NOTE: If an Offeror takes exceptions to the requirements called out in the announcement, the exceptions should be clearly stated in the price proposal.

ATTACHMENT 5: STEP II STATEMENT OF WORK (SOW) FORMAT

A SOW must be included in with the full proposal as part of the Step II submission. The

SOW does not have a page limit but should be approximately 3–5 pages in length and must be a separate and distinct document suitable for incorporation into the procurement instrument. Do not include proprietary data or markings in the SOW. Pages must be numbered and the initial page must show the document date under the title.

The proposed SOW must accurately describe the work to be performed, and performance metrics based on your proposed solution and the objectives in the SOO. The proposed SOW must also contain a summary description of the technical methodology as well as the task description, but not in so much detail as to make the SOW inflexible. The SOW template should include the following sections and specifically respond to the Statement of Objectives

(SOO) the Government provides with the Request for Proposal (RFP):

1. OBJECTIVE. This section is intended to give a brief overview of the project and should describe why the work is being pursued and what the Offeror intends to accomplish.

2. SCOPE. This section includes a statement of what the SOW covers. This should describe all capability areas, goals, and milestones for the effort.

3. BACKGROUND. The Offeror must identify appropriate documents that are applicable to the effort to be performed. This section includes any information, explanations, or constraints that are necessary to understand the project tasks and requirements. This section should describe the effort’s relationship to previous and ongoing efforts.

4. TASKS AND TECHNICAL REQUIREMENTS. This section contains the detailed description of tasks that are necessary to perform the proposed work. These tasks will represent the work to be performed in any potential contract award, and, thus, shall be considered contractually binding. This section should be developed in an orderly progression and presented in sufficient detail to establish the feasibility of accomplishing the overall program goals. This section should clearly distinguish base period tasks from optional tasks. The SOW must contain every task to be accomplished and the metrics by which these tasks will be measured, generally depicted in a Services Summary. Note: The Government reserves the right to modify and negotiate the language in the SOW prior to any potential contract award.

4.1. Task descriptions must be definite, realistic, and clearly stated. Use the phrase

“the contractor shall” whenever the work statement expresses a provision that is binding. Use “should” or “may” whenever it is necessary to express a declaration of purpose. Use “will” in cases where no Offeror requirement is involved (e.g., power will be supplied by the Government. Use active voice in describing work to be performed.

4.2. Do not use acronyms or abbreviations without first defining them. Place abbreviations and acronyms in parentheses following the first usage of the spelled-out phrase.

4.3. If presentations and meetings are identified in the Offeror’s schedule, the Offeror must include the following statement in the SOW: “Conduct presentations and meetings at times and places specified in the contract schedule.”

4.4. The desired project structure consists of base period tasks, focused on demonstrating the feasibility of the technology, and option tasks covering expansion, optimization, and documentation of the plan and implementation scheme. Execution of optional tasks will be dependent upon and determined by the contractor’s performance during and the results produced from the base period tasks.

ATTACHMENT 6: SOLICITATION TOPICS 007 & 016

TOPIC: 007, AIR FORCE INFORMATION NETWORK (AFIN)

The 16th AF seeks innovative and novel solutions to include the following:

• Advance capabilities to install, support and prevent intrusion of systems

• Advance capabilities of the AF global communications network infrastructure

• Advance capabilities of AF computer hardware and software

• Secure, configure, operate, extend, maintain, and sustain DoW (AF) cyberspace and to create and preserve the confidentiality, availability, and integrity of the AFIN

TOPIC: 016, DEFENSE CYBERSPACE OPERATIONS (DCO) & DEFENSE

CYBERSPACE OPERATIONS-INTERNAL DEFENSE MEASURES (DCO-IDM)

The 16th AF seeks the ability to utilize blue cyberspace capabilities and protect data, networks, cyberspace-enabled devices, and other designated systems by defeating on-going or imminent malicious cyberspace activity. This distinguishes DCO missions, which defeat specific threats that have bypassed, breached, or are threatening to breach security measures, from DODIN operations, which endeavor to secure DoW cyberspace from all threats in advance of any specific threat activity. Detect/defend actions that occur within the defended network or portion of cyberspace and dynamically reconfirm or reestablish the security of degraded, compromised, or otherwise threatened DoW cyberspace to ensure sufficient access to enable military missions.

CALL 0008 AI-ESOC OBJECTIVE:

The 16th Air Force seeks a fully integrated, commercially available solution to transform enterprise (Security Operations Center) SOC operations at the 33rd Cyberspace Operations

Squadron (COS) through the deployment of integrated AI-enabled capabilities. The

Government anticipates a single award for an end-to-end solution delivered by a single prime contractor or teaming arrangement that encompasses all three capability areas below.

AI for SOC capability needs (not inclusive):

• Agentic behavioral analytics platform that autonomously detects abnormal and malicious activity across enterprise network environments beyond the capabilities of signature-based detection.

o Continuous ingestion and analysis of network traffic, user behavior, and system activity telemetry at enterprise scale (one million+ endpoints) o High-fidelity finding generation with supporting evidence packages suitable for handoff to automated investigation workflows o Machine learning-driven anomaly detection capable of identifying novel, behaviorally-complex adversary TTPs that evade signature-based tools

• Autonomous security analyst platform that ingests alerts from multiple sources, autonomously investigates across enterprise data sources, and executes cyber task orders with minimal human intervention.

o Flexible deployment architecture supporting air-gapped, cloud, and on-premises environments without requiring data to be transmitted to or shared with the vendor o Generation of complete, fully auditable investigation packages including timeline, supporting evidence, confidence levels, recommended response actions, and natural language narrative summaries; delivered to human analysts for decision and action, with a complete audit trail of all investigative steps taken o Natural language understanding of tasking order intent, enabling autonomous execution of threat hunting tasks (e.g., APT TTP hunting) across enterprise data o Investigate vulnerabilities across available data sets and prioritize results based on findings

• Systems integration partner with demonstrated, verifiable technical experience supporting 33 COS and/or the 688th Cyberspace Wing who will serve as the on-ground technical engineering lead responsible for integrating Capability Areas 1 and 2 within the 33 COS SOC infrastructure.

o Integration of Capability Areas 1 and 2 with existing 33 COS infrastructure including data source APIs, authentication and authorization systems, and network architecture o On-site technical engineering support throughout the base period and option periods o Support for Interim Authority to Test (IATT) processing and security documentation o Coordination with 33 COS analysts, government program leads, and vendor technical teams o Documentation of integration architecture, configuration, and procedures sufficient to support scaling to additional 16th AF units and other organizations in option periods

PILOT OPERATIONAL FRAMEWORK

Each proposal must present a phased execution framework outlining the operational approach, sequencing, and expected outcomes by phase. While no specific technical architecture is prescribed, the Offeror shall clearly demonstrate how the proposed approach achieves mission objectives in a structured and scalable manner.

Technology Readiness Level requirement: All proposed capability areas must be at TRL 7 in accordance with the Technology Readiness Assessment Guidebook (TRAG) (February 2025) or higher at time of proposal submission. Technology Readiness Assessment Guidebook can be found using an internet search engine by simply searching for the title. The guide is also available at:

https://www.cto.mil/wp-content/uploads/2025/03/TRA-Guide-Feb2025.v2-Cleared.pdf https://www.cto.mil/wp-content/uploads/2025/03/TRA-Guide-Feb2025.v2-Cleared.pdf

ATTACHMENT 7: EVALUATION CRITERIA AND SELECTION PROCESS

The Government will review each Quad Chart and White Paper (Step I) and select offerors with the greatest potential to meet the operational needs of 16th Air Force based on the capability areas in Attachment 6. A determination will first be made whether each offeror is technically qualified and has a comprehensive understanding to execute the proposed solution based on the information stated in the Quad Chart/White Paper.

The offeror is advised that only Firm Fixed Price (FFP) or Fixed Price Incentive (FPI) contracts may be awarded as a result of this CSO Call.

The Government will determine the most technically competent and capable of the qualified offerors using the criteria below:

• Criteria (Factors) for Selecting Quad Chart/White Paper for Full Proposal Submission:

o Technical merit/applicability, o Importance to 16th Air Force mission, and o Fund availability

• Relative Importance: All Factors are of equal importance

• Method of Evaluation: Peer or scientific review