RFI White Papers QA.docx

Q&A Pulled from RFI Responses

· Section 7.2.3 states that contractor personnel should have a SECRET security clearance at time of award. Could the Government clarify if this is just for the initial IDIQ award? If so, how are offeror’s evaluated for this – based on the IDIQ PM?

· All personnel performing work on the contract are required to have a minimum of SECRET, but many workloads will require higher level of clearances. For contractors to gain access to government development systems a SECRET clearance is often the minimum requirement for personnel to be granted access.

· Could the Government clarify the nature of “threat representative capabilities” as mentioned in section 1.3 Scope? Additionally, which section of the Basic Services aligns this scope statement?

· The integration of or creation of intel community models that represent threat systems.

· Could the Government clarify the evaluation criteria for subsequent TOs on the vehicle?

· This is still being worked, official RFP release will have clear evaluation criteria defined.

· Modeling and Simulation capabilities: Is AFSC/SWX seeking a MODSIM environment for multi-level security (MLS) with cross domain solutions (CDS) built-in?

· SW has these capabilities, there could be future task orders that require experience in these areas.

· How will cloud-based services be used to fulfill the scope?

· Many SW developmental systems are interconnected with cloud-based systems. Specific workloads will identify use of those systems when required.

· What is AFSC/SWX’s multi-cloud plan?

· SW uses hybrid-edge cloud development environments.

· What percentage of the scope will be cloud-based and what percentage will remain in the local government datacenter at Wright-Patterson?

· SW uses hybrid-edge cloud development environments. Some development drives edge compute requirements for integration with hardware-in-the-loop or other requirements. The scope of work varies across primary performance locations, their specific workloads, and in some cases may be clarified in specific task orders.

· Will Hybrid architecture be in scope; where hybrid is defined as: hyperscale cloud services and on-premises services?

· SW uses some of these capabilities today. In the event that specific work in cloud architecture is required for a specific workload it will be identified in a task order level requirement.

· Which Impact Levels will be in scope? Please list if SAP/SAR is required.

· Work is currently performed at IL5 and IL6 levels using SW’s own cloud infrastructure. IL6+ is also required.

· Will cloud-based, NSA raise the bar (RTB) compliant cross domain solutions (CDS) be in scope? Does AFSC/SWX need to connect different cloud-based Impact Levels?

· SW does require RTB compliant CDS when applicable to specific workloads.

· Will Virtual Desktop Instances (VDI) be needed? If so, at which Impact Level?

· SW does use VDIs at all Impact Levels.

· Cybersecurity: Is AFSC/SWX planning on adopting cloud-based cybersecurity services that can accommodate both on-premise, cloud-based and disconnected operations?

· SW does use cloud-based cybersecurity services that can accommodate on-premises and disconnected operations.

· What platforms or systems will be developed and sustained?

· The breadth of systems crosses a majority Air Force Mission Design Series (MDS) aircraft. The scope of potential work spans a variety of work domains including but not limited to modeling and simulation, aircraft operational flight program (OFP), command and control (C2) systems, mission systems development and integration, space systems, across all generations of systems.

· What is the current DevSecOps environment, architecture, and tool set currently being used?

· There are multiples DevSecOps environments. Most of these environments are built upon common COTS and GOTS technologies.

· Does the Government desire a solution for contractor managed software development environment or plan to host within government services?

· Specific workloads may require a contractor managed solution, but most often the software development environments will be government provided with contractor involvement in the stand up and operation of those government owned and managed systems.

· What type of labor categories are required, and will they be located on Government site or Contractor Site for this follow-on effort?

· Multiple government sites across the country, specifically Wright-Patterson Air Force Base (AFB), Hill AFB, Tinker AFB, Warner-Robins AFB, Nellis AFB, and other government location as required. Labor categories are best inferred from the requirements within the PWS.

· Confirm that the contractor will use Government provided Desktop and/or Laptop computer equipment, and Government provided Test Equipment to perform daily activities for this program in the WPAFB secure facilities, other CONUS facilities, and OCONUS facilities throughout the contract period. Or specify the contractor requirements to provide these capabilities.

· Most often the contractor will use Government provided equipment. In specific task orders the contractor may be required to procure material for performance of work.

· Will the Government please confirm the primary place(s) of performance for this contract?

While the SAM listing identifies Hill AFB, UT, an attached document references core locations including Wright-Patterson AFB, OH; Dayton, OH; and Nellis AFB, NV, with secondary locations as RFI Response Department of the Air Force SMARTEC Notice ID: FA8222-25-R-SMTEC TBD. Clarification of primary and secondary locations, as well as any anticipated TDY requirements, would be appreciated.

· Multiple government sites across the country, primary locations: Wright-Patterson Air Force Base (AFB), Hill AFB, Tinker AFB, Warner-Robins AFB,

· Secondary and TDY locations: Nellis AFB, Edwards AFB, Eglin AFB, and other government location as required.

· Is all classified work conducted at Government provided facility or does the contractor need to provide a classified space for processing?

· Government provided facilities.

· Does the contractor need to have knowledge or experience with Joint Simulation Environment (JSE), Next Generation Threat System (NGTS), Distributed Interactive Simulation (DIS), High Level Architecture (HLA), or Live Virtual Constructive (LVC)?

· Will the government identify the preferred tools for DevSecOps?

· The specific tooling used in existing pipelines is controlled information.

· What operating system is required to develop software in?

· Typically, Windows and Linux Operating systems.

· Is any work able to be conducted and transferred to government classified systems?

· Yes, depending on the work.

· Following an agile methodology what process is recommended or required?

· SW uses both agile scrum and scaled agile methodologies depending on the workload.

· Is the process up to the contractor’s discretion?

· Process final decision making is up to Government. Contractor plays significant role in process development and refinement over time and execution of work.

· What advanced model types, simulations, or software capabilities?

· The breadth of systems crosses a majority Air Force Mission Design Series (MDS) aircraft. The scope of potential work spans a variety of work domains including but not limited to modeling and simulation, aircraft operational flight program (OFP), command and control (C2) systems, mission systems development and integration, space systems, across all generations of systems.

· What legacy or new platforms and systems?

· The breadth of systems crosses a majority Air Force Mission Design Series (MDS) aircraft. The scope of potential work spans a variety of work domains including but not limited to modeling and simulation, aircraft operational flight program (OFP), command and control (C2) systems, mission systems development and integration, space systems, across all generations of systems.

· Is the software sustainment on already existing code?

· Both sustainment on existing code and the development and sustainment of new code.

· Does the government have general purpose rights for existing code?

· Given the wide variety of workloads, data rights vary depending on the project. SW tends to have unlimited rights at source code level for existing code bases. Some code base rights may vary depending on the program.

· Is integrating with F-16 virtualized, real-world, or certain components of the airframe?

· In some workloads we do integrate M&S products with real world hardware or aircraft systems.

· Does the government expect to integrate a M&S solution with this airframe?

· In some workloads we do integrate M&S products with real world hardware or aircraft systems.

· For software testing and plans what is the expectation of format and types of tests? Is the government looking for unit tests, Common Vulnerability Exposure (CVE) reports, vulnerability testing, or something different?

· All of the above, specific requirements vary per Authorizing Official with cognizance over the specific system being used to perform a workload.

· Could the government identify the type of cybersecurity testing for vulnerability testing of hardware and software? Recommend minimum experience requirements are: Security Technical Implementation Guides (STIGs), Risk Management Framework (RMF), and auditing syst

· Experience with STIGS, RMF, JSIG, code analysis tools, essentially all facets of cybersecurity testing and reporting.

· Could the government identify the V&V testing of software and hardware for the government owned software?

· What facility security inspections are to be conducted?

· All security self and third-party inspections typically required for secure facilities.

· Could the government provide specific training that is required?

· The training is in multiple knowledge areas including but not limited to Agile and DevSecOps expertise, Tactics, Techniques and Procedures for air-to-air engagements or other warfighting domains, bespoke training for software products developed by the government and/or contractor teams, see section 2.5.2 of the PWS.

· Is this for the software created?

· In some cases providing training for software created may be required.

· Could the government provide specific security services that are required?

· Physical security requirements for all facility classification levels including but not limited to: access control, visit requests, personnel security, mail, logs, authoring and enforcing standard operating procedures, security related training.

· Could the government breakout the different security requirements for cybersecurity and facility security?

· They are broken out separately in the PWS.

· Is the Government considering setting aside certain portions of the PWS for Small Businesses?

· At this time, we are anticipating full and open competition on the MAC. However, we are looking into best ways to guarantee small business participation.

· Will the contractor receive Intel Community-provided models, or will there be a requirement to develop threat models independently?

· Intel Community (IC) provided models when applicable. Where they do not exist and appropriate the contractor may be tasked with producing such models in collaboration with the IC.

· Will RMF accreditation follow a standard DoD ATO process, or are specific cybersecurity frameworks anticipated beyond STIG compliance?

· Every Authorizing Official has systems specific requirements they levy as supplemental or in implementation of RMF and the JSIG.

· Will integration take place at existing Air Force simulation labs, or does the Government expect contractors to provide test environments for validation?

· In many cases within existing laboratories, on a task order by task order basis contractors may be tasked with establishing additional test environments for new workloads.

· Section 2.2.1.4: Define the process or template required for “written consent” for introducing proprietary software/data.

· For any specific workload or product development it would be a deliberate decision made by the product owner and the issuer of the task order, worked with the contracting officer to facilitate the consent of introduction of proprietary software/data.