Q and A for SPARTAN RFI 2_16 Sept 2025.pdf

Q and A - SPARTAN RFI 2_16 Sept 2025

Ques No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

1 RFI 2 Letter General Draft RFP Is a Draft RFP planned for the SPARTAN MAC IDIQ? If so, when is the expected release date of the Draft RFP?

The Government has not made any final decisions on whether draft RFP will executed.

2 RFI 2 Letter General RFP Release When is the expected release date of the Final RFP for the

SPARTAN MAC IDIQ?

Any expected timelines (to include RFP, award, etc.) can not be determined at this time.

3 RFI 2 Letter General Number of Awards How many Prime awards are expected for the SPARTAN MAC

IDIQ?

The Government will inform potential offerors at a later date.

4 RFI 2 Letter General Task Orders Will Task Order(s) (TOs) be awardable upon award of the

SPARTAN MAC IDIQ?

Yes.

5 SOO Capability Area Which of the 10 Capability Areas (CAs) outlined in the Statement of Objectives (SOO) are expected to be addressed in the initial Task Orders?

CAs will be addressed as determined by priority of IDCS execution (TBD).

6 SOO 2 Capability Area Are there any CAs that are considered higher priority for immediate implementation?

IDCS PMO is considering options for Oral presentations currently for both the overarching IDIQ, and at the Task Order level.

7 SOO 2 Capability Area Will Task Orders focus on single CAs or multiple, integrated CAs?

One (1) given CA will drive specificity to a Task Order, however, the co-mingling of CAs to execute a given Task Order is likely, i.e. CA1 (cloud) and CA6 (compliance) in a single award to ensure objectives are met.

8 SOO TO Awards When is the expected award and start date for initial Task Orders on the SPARTAN MAC IDIQ?

The Government will inform potential offerors at a later date.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

9 RFI 2 Letter General Oral Presentations To streamline the solicitation process and provide a means for the Government to directly validate offeror competency, will the Government be including Oral presentations as part of the solicitation and evaluation process?

At this present time the Government is evaluating all forms of responses to include: oral/briefing, video presentation, or written. Offerors will identified at the discretion of the Government if further clarification is needed and that method.

10 LCAT Table General LCAT The following Labor Categories (LCATs) are listed as Key Personnel Positions (KPP) in Attachment 2 SPARTAN LCATS Table: Threat Intelligence Analyst, Cybersecurity Research Scientist, Vulnerability Researcher, and Red Team Operator. Will the Government be revising KPP based on LCATs associated to particular CA(s) where such CA(s) are associated to particular Task Order(s)?

Yes, the provided LCAT table is merely a overarching notional inventory for the entire SPARTAN IDIQ. We are seeking inputs on revisions/additions to the table to ensure ~99.9999 coverage of LCATs that will be required for the entirety of the contract. KPPs and LCATs will be determined by Task Order requirements.

11 SOO Para 4.5,

4.5.3 – 4.5.10

Capability Area For CA 1 and CA 2, General, Task Description, and Performance Standards are provided, but for CA 3 through CA 10, only General and Task Descriptions are provided. Are there Performance Standards or will Performance Standards be provided for CA 3 through CA 10?

Performance standards will be provided for all capabilities.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

12 RFI 2 Letter General RFP Release Does the Government plan to release a draft RFP, to include an updated SOO and draft Section L&M criteria, based on this RFI feedback, or just release an updated SOO?

IDCS PMO is considering options for Oral presentations currently for both the overarching IDIQ, and at the TO level.

13 SOO All Mention of SPARTAN vs IDCS

The document seems to oscillate between "IDCS" and "SPARTAN" names, inferring these terms are interchangeable. It seems that sometimes "SPARTAN" is meant when saying "IDCS". Is it possible to clarify the Government's specific difference between IDCS and

SPARTAN?

SPARTAN is the name of the contract vehicle; IDCS is the System-of-Systems

14 SOO 2. Scope Scope (IOP) Document states: "Interoperability Platforms (IOPs) will be sustained until their tasks are fully absorbed by IDCS." Will the new contract performer be responsible for all sustainment for all previous and new weapon systems platforms?

See Amend. 1, Attachment 1, SPARTAN SOO_Rev 16 Sept 2025, Section 2. Scope, IOP should have been defined as Information Operations Platform. No. The performer will be responsible to specific Task Orders associated with their respective award/s and requirements.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

15 SOO 2. Scope Scope (IOP) Document states: "Interoperability Platforms (IOPs) will be sustained until their tasks are fully absorbed by IDCS." Is the IOP sustainment expected to be performed by the incoming contractor?

See Amend. 1, Attachment 1, SPARTAN SOO_Rev 16 Sept 2025, Section 2. Scope, IOP should have been defined as Information Operations Platform. All IDCS efforts and technical requirements are currently being assessed to identify which programs, and sustainment efforts are best suited for inclusion in the SPARTAN MAC IDIQ vehicle. Therefore, if IOP transitions to the SPARTAN vehicle, yes, IOP will potentially transition to the most suitable vendor.

16 SOO 2. Scope Scope (IOP) Document states: "Interoperability Platforms (IOPs) will be sustained until their tasks are fully absorbed by IDCS." Does IOP sustainment include VOLTRN+?

See Amend. 1, Attachment 1, SPARTAN SOO_Rev 16 Sept 2025, Section 2. Scope, IOP should have been defined as Information Operations Platform. No.

17 SOO 2. Scope Scope (IOP) Document states: "Interoperability Platforms (IOPs) will be sustained until their tasks are fully absorbed by IDCS." Are there other IOPs to be sustained by the performer?

See Amend. 1, Attachment 1, SPARTAN SOO_Rev 16 Sept 2025, Section 2. Scope, IOP should have been defined as Information Operations Platform. There is only one IOP program and capability with in the PMO.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

18 SOO 4.5.6.1 C5I Support The Government states, "The IDCS aligns three (3) defensive cyberspace weapon systems into a single, configurable platform that enables operators to sense, make sense, and act with speed, precision, and common data."

Will the Government provide a detailed overview description of each weapon system (CVA/H, ACD, and CDA) supported under this contract?

More details will be provided as part of the RFP with the addition of a potential CUI level reading room. It will require DoD CAC/ECA and DoD email to access it.

Instructions will be provided as part of the RFP package. Detailed requirements will be provided for Task Orders with any applicable/ supporting core documentation.

19 SOO All No diagrams Is the Government amenable to sharing OV-1s and architecture diagrams of the current IDCS implementation?

More details will be provided as part of the RFP with the addition of a potential CUI level reading room. It will require DoD CAC/ECA and DoD email to access it.

Instructions will be provided as part of the RFP package. Detailed requirements will be provided for Task Orders with any applicable/ supporting core documentation.

20 SOO 4.5.6.2 Contractor shall develop, assist with integration, and sustain C2 applications.

This description seems to go beyond the SPARTAN platform into the development of C4I Mission Applications. Is the Government asking the provider to develop and help develop C4I Mission Application software that would ride on SPARTAN?

SPARTAN is the name of the contract vehicle; IDCS is the System-of-Systems.

Currently, in most cases the integration of Kubernetes containers (.yaml, etc.) and analytics will constitute the extent of development to be performed by the developer.

It is anticipated that future requirements require development of custom C2 applications.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

21 SOO 5.4 Travel The Government states, "The Contractor may be required to travel to various locations within the Continental United States (CONUS) and Outside the Continental United States (OCONUS) in performance of this contract.

Will the Government provide a separate travel CLIN with a ceiling to ensure all offerors provide the same value?

The Government has not made a determination on CLIN structure but will inform potential vendors at a later date.

22 SOO Appendix A, 4. IDCS Capability Areas & Objectives Matrix

"ELX" is mentioned once. Will the Government please define this acronym?

See Amend. 1, Attachment 1, SPARTAN SOO_Rev 16 Sept 2025, Appendix A, Section 4.1 has been updated to spell out ELX and BDP.

23 SOO Appendix A, 5. IDCS Capability Areas & Objectives Matrix

The Government identifies, "Support integration efforts with solutions from multiple vendors, ensuring a cohesive and unified IDCS SoS." Can the Government identify if the 10 CA areas will be performed by multiple contractors via separate task orders?

The 10 CA areas are overarching to the entire IDCS SoS. Therefore, as an example, there will be multiple Task Orders competed under any given CA of the 10 CAs. Providing multiple opportunities for vendors to compete and/or team for these CA Task Orders to increase business opportunities within industry.

24 SOO All No diagrams Is the Government amenable to sharing OV-1s and architecture diagrams of the current implementation?

OV-1s and other architectures will be identified within the SPARTAN RFP and /or a potential industry day or similar activity (if the Government elects to conduct these activities)

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

25 RFI 2 Letter 3.4.1 The Government provides a list of support vendors, but not a list of current performers and contracts being performed.

Will the Government provide a list of current performers (not support vendors) and contract numbers at assist industry in collaborating with industry partners for forming the best aligned team?

No

26 RFI 2 Letter 4 Industry Discussions Will the Government consider hosting a classified meeting with interested parties to discuss operational requirements?

No

27 RFI 2 Letter N/A SCIF How many seats are available for the contractor within the Government-provided SCIF?

Classified facility seats may be required. It is highly encourage for vendors to have their own classified facility access, or consider vendor teaming to increase meeting IDCS classified facility requirements. The security requirements for secure facilities are currently being considered by the IDCS PMO.

28 RFI 2 Letter N/A SCIF Will the Government be willing to sponsor a contractor-provided SCIF to support operational requirements?

No - Not at this time.

29 LCAT Table General FTE Will the Government provide an initial estimate for a baseline FTE count to support the initial tasks?

No, not at this time.

30 SOO 2 Scope (IOP) Document states: "Interoperability Platforms (IOPs) will be sustained until their tasks are fully absorbed by IDCS." Will the Government please define the available Interoperability Platforms?

See Amend. 1, Attachment 1, SPARTAN SOO_Rev 16 Sept 2025, Section 2. Scope, IOP should have been defined as Information Operations Platform. The IOP is a legacy DoD USAF GOTs IDPS Sensor platform. These systems are limited in quantity.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

31 RFI 2 Letter 2.5 Contract that interface with the

SPARTAN IDIQ

Will the Government confirm if there are other programs or contracts that interface with SPARTAN IDCS? If so, please provide relevant, appropriate technical details for interface requirements.

The Government can not identify this at this time.

32 RFI 2 Letter 2.5 Integration Please confirm if there are specific integration requirements with other Air Force or DoD systems we should consider in our technical approach.

Yes, IDCS, and legacy systems by design integrate into AFIN and AFNET as they are the Defense Cyber Systems for the USAF.

33 RFI 2 Letter 2.1 Cloud Solution Provider

Please confirm who is holds the relationship and contracts with CSPs (AWS, Azure, etc.) - the Government or the contractor.

The Government holds the contracts with CSPs

34 RFI 2 Letter 2.11.2 Surge What historical surge requirements have you experienced, and what response timeframes are expected for surge staffing?

Not providing at this time. Surge requirements potentially will be determined by each specific Task Order. There will be further direction in the RFP pertaining to surge.

35 RFI 2 Letter 2.9 Performance Measures

Will the Government provide current performance baselines for key metrics such as system availability, incident response times, and deployment frequency?

This will be identified at the Task Order level.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

36 SOO 5.1 Remote work and clearance levels

Please provide the percentage of the work must be performed on-site in San Antonio versus remotely? Are there specific roles or clearance levels that mandate physical presence, and is there flexibility for reach-back support from other cleared facilities?

IDCS work performance is primarily in San Antonio, TX. Vendors should plan their staffing for ~>75% of Task Order execution to be performed in San Antonio, TX. KPPs are required to be in San Antonio, TX for the duration of their awarded task (more details will be in RFP).

37 RFI 2 Letter 2 Small Business Set Aside

Will SPARTAN use small-business set-aside pools and/or socio-economic tracks? How many awards are envisioned, with what ordering period, ceiling, and minimum guarantee per awardee?

The Government is considering small and large business pools for SPARTAN however the market research results will determine the selected course of action.

38 RFI 2 Letter 2 On-Off Ramp IDIQ Vendors

How will on-/off-ramping work over the life of the MAC IDIQ, and will there be pool competitions at the Task Order level or best-fit directed awards?

The Government is currently exploring various on-/off-ramping strategies and task order award approaches, including potential pool competitions and best-fit directed awards, with all decisions remaining pre-decisional pending further market research.

39 SOO 4.1 Artifacts Which acquisition artifacts will be tailored under the Software Acquisition Pathway (e.g., what is required vs. waived)?

Tailored artifacts, and remaining artifacts (to be executed) will be determined and communicated at a later date.

40 RFI 2 Letter 2 Ordering Guide/ Sample TO Eval Criteria

Will the Government publish a draft Ordering Guide and sample Task Order evaluation criteria prior to solicitation?

The Government will inform potential offerors at a later date.

41 SOO/RFI 2

Letter

2.3/2 IS-ICD and RDP Documents

When will the IS-ICD and RDPs be released, and in what sequence (to support meaningful TO pricing/schedule)?

See SOO, Section 4.5

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

42 SOO Appendix A Appendix A Will the IDCS Capability Areas & Objectives Matrix (Appendix A) be shared in editable form to support traceability?

The editable IDCS Capability Areas & Objectives Matrix will be provided as part of the RFP.

43 SOO 4.5.4.2 Backlog Who is the “delegated lower-level requirements authority” referenced for the dynamic backlog, and what is their cadence for prioritization?

The Chief Engineer is the requirements authority and the Technical Integration Lead Engineer is delegated authority to conduct the lower-level decomposition of requirements. When engineering solutions are ready for implementation, they are added to the backlog(s) of development teams based on a quarterly prioritization determined with inputs from lead command and stakeholders.

44 Whitepaper Template

Technical & Security Capabilities

CMMC Level 3 Please confirm whether CMMC Level 3 compliance is a formal requirement for offerors at the time of IDIQ award, or if this is requested only for informational purposes at the RFI stage.

This RFI is for market research, including gathering feedback on the application of CMMC Level 3 to all or some IDCS capabilities. Your input will help balance fair competition with appropriate compliance levels for critical aspects of the IDCS System of Systems.

45 Whitepaper Template

Whitepaper Template – Technical & Security Capabilities

CMMC Level 3 If required, will compliance be at the organizational level or flowed down to subcontractors as well?

CMMC requirements that are placed on prime contractors will flow down to subcontractors but the IDCS PMO is assessing the tailoring of flow-down CMMC requirements to the subcontractor.

The tailoring determination will likely be made based on the Critical Defense Information (CDI) that will flow-down to the subcontractor --this will drive CMMC compliance requirements and Government approval/disapproval/s (DFAR 252.204- 7012)

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

46 Whitepaper Template

Whitepaper Template – Technical & Security Capabilities

CMMC Level 3 If not required at award, is CMMC Level 3 expected to be a future requirement for task order execution?

CMMC level 3 compliance as of the RFI is a market survey information request.

CMMC strategy will be finalized at RFP.

47 Whitepaper Template

Whitepaper Template – Technical & Security Capabilities

CMMC Level 3 The RFI indicates the Government’s intent to encourage broad participation, including from small businesses and socio-economic categories. We are concerned that making CMMC Level 3 compliance mandatory at base award would significantly restrict small business participation. Can the Government clarify whether it will provide a phase-in period, alternate compliance pathway, or risk-based approach to avoid unintentionally excluding small business vendors?

We will take the suggestion into consideration. More details on what the Government will accept for CMMC will be provided within the RFP

48 SOO 4.2 Government-as- Integrator & Teaming

With the Government serving as system integrator/product owner, what governance forums (e.g., PI planning, change control) will vendors participate in, and what are the decision rights?

Vendors will be informed of decisions made as part of the change management.

Vendors will receive direction on planning priorities. The Government will seek vendor input to assist in decision making as needed.

49 RFI 2 Letter 3.4.1, Table 2 Associate Contractor Agreements

Please provide (or confirm) the list of associate/partner contractors we will be required to coordinate with via ACAs; is Table 2 the initial set?

No, ACA's have not been identified yet, because the IDIQ had not been awarded.

This would occur after award. The vendors listed in Table 2, are names of vendors that are part of the Governments Non- Government Advisors.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

50 SOO 4.2.1 Associate Contractor Agreements

Will a Government-provided ACA template be issued, and can you clarify data-sharing expectations and conflict resolution under ACAs?

We will take the suggestion into consideration. All data that will be created under this contract will fall within the FAR clauses and will belong to the Government.

The Government intends to share relevant data to other vendors when necessary to ensure what is being developed will operation with the IDCS system.

51 SOO 4.3 Operating Constraints Open Standards

Section 4.3 prohibits “proprietary formats” yet allows limited proprietary technologies with justification—please define acceptable exceptions (e.g., cloud-native managed services) and the approval process.

HNCD Leadership is the approval authority for any deviations or implementations that will result in vendor proprietary tools, software, interfaces, protocols, schemas, formats, extensions, encryption, encoding, or services.

52 SOO 4.3 Operating Constraints Open Standards

What specific data models, schemas, and interface standards will be mandated up-front vs.

defined per TO?

The IDCS PMO is not sharing this data at this time. There are considerations for facilitating a 'data-share' reading room, vendor one-on-ones, or sharing requested data through future solicitations.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

53 SOO 4.4 Cloud Environments Technical Expertise

Which target environments are in scope at program start (Cloud One, Platform One, JWCC, others), at which classification levels, and what CDS approach is expected?

4.4 requirements are beyond just hosting environments within cloud CSPs. All environments are within scope as well as others. All classifications are within scope moving data up through the CDS. CDS will be defined by the Government at time of award of future task orders. More details will be provided as part of the RFP with the addition of a potential CUI level reading room. It will require DoD CAC/ECA and DoD email to access it. Instructions will be provided as part of the RFP package.

Detailed requirements will be provided for Task Orders with any applicable/ supporting core documentation.

54 SOO 4.4 Cloud Environments Technical Expertise

Will Government provide landing zones and ATO baselines in each enclave, or is the contractor responsible for establishing them?

The Government seeks for the vendor to provide this effort as defined by enclave or hosting CSP.

55 SOO 4.5.1.3 Performance Standards 99.9% Uptime

CA-1 specifies 99.9% infrastructure uptime; are there RTO/RPO, latency, and backlog burn-down targets to accompany uptime?

System performance is specified via the IS-

ICD.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

56 SOO 4.5.2.3 Performance Standards quality levels of DevSecOps

CA-2 lists DevSecOps metrics, but minimum standards are “to be identified in TOs.” Can you publish baseline thresholds/targets for MTTD/MTTR/deploy frequency now to guide solutions?

While specific minimum thresholds for DevSecOps metrics like MTTD, MTTR, and deployment frequency will be defined at the task order level to account for varying system complexities and operational contexts, the Government anticipates baseline targets generally aligned with industry best practices for continuous improvement and rapid incident response, as reflected in the DoD Enterprise DevSecOps Reference Design and Strategy Guide.

57 SOO 4.5.2 Performance Standards & Metrics

Will there be a standardized QASP and code quality “Assessment Matrix” shared pre-solicitation for estimating compliance effort?

Yes, a QASP will be included/required for all Task Order's, and assessment matrices will be shared with applicable Task Orders.

58 SOO 8.4 Data Rights The SOO states the Government will acquire “unlimited rights” to all technical data and computer software developed for IDCS.

Please confirm treatment of: (a) pre-existing IP/background components, (b) commercial licenses, and (c) OSS with reciprocal licenses.

The intent of is statement is in reference to GOTs, and highly modified and secured FOSS that is within the scope of the license agreement/published. Anything that is solely developed under this contract shall be unlimited rights to the Government IAW DFAR clauses 252.227-7013, 252.227- 7014, 252.227-7018 and 252.227-7025.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

59 SOO 5.1, CDRLs CDRL Several CDRLs imply delivery of SBOMs and source code; which artifacts are mandatory for all TOs

vs. “as needed,” and what repositories (e.g., Iron Bank/DoD repo) must we use?

In alignment with EO 14028 and cybersecurity maintenance needs, the Government anticipates requiring SBOMs (in machine-readable format) for software deliverables, with specific artifact requirements detailed in Task Order solicitations; furthermore, source code access will be necessary for cybersecurity code analysis, and the Government expects utilization of DoD repositories and/or Iron Bank, reserving the right to leverage any Government resource to support program objectives, unless otherwise directed.

60 SOO 5.1, CDRLs CDRL Will the “Data Rights Assertion List” be required at IDIQ level or per TO, and what assertion format is expected?

The Government reserves the rights to request a Data Rights Assertion List.

61 SOO 3.3 Clearance Is an active TS/SCI FCL required at base award, or will the Government accept proof of sponsorship/in-process?

See Amend 1, Attachment 1_SPARTAN SOO_Rev 16 Sept 2025, Section 7.1 The requirement will consist of scope ranging from Unclassified up to including Top Secret/SCI, the government seeks a qualified vendor pool for entire scope and will not accept any “in-process" TS/SCI FCLs, the government does encourage teaming and/or partnering with current TS/SCI FCLs companies.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

62 SOO 3.3 Clearance The SOO requires 20% of staff “actively cleared upon award,” plus cleared KPPs, with potential polygraphs. Please define: (a) which LCATs count toward the 20%, (b) timing for meeting the percentage, and (c) when/whether polygraphs will be imposed.

See Amend 1, Attachment 1_SPARTAN SOO_Rev 16 Sept 2025, Section 7.1.1.1 was removed.

63 SOO 3.3 JIRA/Confluence Access

All positions require CAC/ECA access to Jira/Confluence—will accounts/environments be Government-provisioned, and what lead times should we plan?

Accounts and CaC access will be provisioned by the Government upon new awards. The lead time for getting into JIRA once a person has a CaC should be 1-3 days depending on volume of requests. The duration of time it takes to get a CaC could vary based on if a the have a Clearence or has been vetted in the past.

64 SOO 5.1 Place of Performance KPPs must be local to San Antonio or commute 4–5 days/week. How many KPPs (by role) are anticipated, and are hybrid/remote exceptions possible for non-KPP staff?

Government is still evaluating the percentage threshold for KPPs and all cleared personnel, and will be further defined at RFP.

65 SOO 5.2 Hours/Duty Days Normal duty hours are specified;

is any 24x7/after-hours support required for incident response, and how will surge be handled?

Some CAs may require 24/7 normal duty hours that will be decided at the task order level. Government is still evaluating methods in which surge will be utilized and will be further defined at RFP.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

66 LCAT Table LCAT Table LCAT The LCAT workbook (Attachment 2) guides skill levels.

Will the Government publish mandatory certs per LCAT (e.g., DoDI 8140 mappings) and identify any missing roles they want industry to propose?

Yes however, they are subject to change as new certifications become an industry standard and IAW with DoD policy and to meet the requirements associated with a Task Order

67 SOO 5.2 Hours/Duty Days Please confirm whether remote work is authorized outside San Antonio for non-KPP roles across all TOs.

Remote work for certain positions may be authorized based on the requirements associated with that TO. If remote work is approved, Travel to San Antonio for tasks required to perform will be at the cost of the Vendor.

68 SOO 3.5 Focal Point The Focal Point must respond within 12 business hours; what constitutes “urgent” communications, and are there SLA penalties?

12-business hours is a reasonable amount of time to respond to initiated communication. SLA penalties will be dictated as part of a SLA/Task Order.

69 SOO 3.5 N/A What is the expected cadence/format for MSRs, PI planning, and quarterly reviews across vendors?

Cadence/Format will be determined at RFP and could be modified based off task order requirements.

70 SOO 10.3 RACIQ Template Will the Government provide a standard RACIQ template and define approval criteria ahead of proposal?

Yes. The intent is to ensure there is a standardized effort that identifies key shareholders and stakeholders across the entire IDCS effort.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

71 SOO 7.4.1 Testing Will Government furnish an ATO “inheritance” package and approved control baselines, or are contractors expected to generate full RMF packages per component?

In accordance with Cyber Security implementation, as outlined in DoDI 8500.01, the Government intends to provide an ATO inheritance package, including approved control baselines aligned with NIST SP 800-53, to facilitate efficient RMF compliance; however, contractors will be responsible for tailoring and supplementing the package to address component-specific controls and unique system characteristics, ensuring comprehensive security and alignment with the overall IDCS security architecture, as per the risk management framework.

72 SOO 4.5.8 Testing Which Zero Trust and Cyber Survivability Attribute artifacts are required at baseline vs. per TO (e.g., A090 ZTA Implementation Report; CSA Compliance Assessment)?

The Government is evaluating the allocation of ZTA/CSA artifact requirements, expecting a high-level ZTA Implementation Report (A090) and CSA Compliance Assessment (A091) at the IDIQ level to demonstrate initial compliance; specific artifacts will then be tailored and required at the Task Order level based on system/mission needs (SOO 7.4.1, 7.4.2), with RMF security packages (A070) & compliance with enterprise ZT policy developed per Task Order and details to follow as CMMC evolves.

73 SOO 4.5.8 Testing Are Certificate-to-Field (CtF) requirements and Iron Bank hardening mandatory for all software deliveries?

Yes.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

74 SOO 11, Table 1 CDRL Table 1 is labeled “Example CDRLs” while also reserving the right to add more. Which CDRLs are baseline across the IDIQ vs.

TO-specific?

At this time there are no CDRLs that will be required as part of the IDIQ. CDRLs will be identified at the TO for what is required as part of that scope.

75 SOO 5.1, DFARS 25CDRL For cost/schedule data (CSDR, SRDR/FlexFile, Quantity Data), will these apply to FFP TOs, and what thresholds trigger them?

For CSDR, SRDR/FlexFile, and Quantity Data reporting—are potentially applicable even to FFP Task Orders—determinations will be Task Order-specific (DFARS 234.71, DoDI 5000.73) based on dollar value, complexity, and risk; thresholds, aligning with DoD CSDR policy, will be in Task Order solicitations, balancing Government visibility and contractor burden.

76 SOO 5.1, CDRLs CDRL Several security/DevSecOps deliverables are “Monthly or Quarterly (IAW TO).” Can the Government publish default frequencies now (e.g., VARs, container scans, IaC scans)?

Deliverables will vary based on TO.

77 SOO 3.4 Training CA-9 requires a multi-tier service desk and training. What are target service levels (e.g., call answer times, first-contact resolution) and required training modalities (ILT, VILT, CBT)?

Specific target service levels (e.g., call answer times, first-contact resolution) and required training modalities (ILT, VILT, CBT) will be determined and defined at the task order

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

78 General 3.4 Training Are there Government-furnished training environments and representative datasets for courseware/testing?

The PMO is responsible for Type-1 training. Currently the PMO only provides 1 area for mission rehearsal for 1 weapon system. There are current datasets and courseware for the Type-1 training, however the predominance of these artifacts are for legacy systems.

79 SOO 5.4 Travel Forecasting Please define anticipated CONUS/OCONUS travel volumes by role and typical trip duration for planning purposes.

While specific CONUS/OCONUS travel volumes and trip durations will be defined at the task order level. The Government anticipates travel requirements to vary based on role and task complexity/duration;

Contractors shall propose travel volumes, durations, and types, with their SOO solutions and will also consider travel is pre-approved and required based on the mission need, while minimizing costs where possible.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

80 SOO 2.1.4 Cloud Services, Hybrid Architecture, and Scalability:

Describe your experience designing and implementing cloud services and hybrid architectures that meet demanding performance and scalability requirements in DoD environments (similar to IDCS), especially with Cloud One and Platform One. Provide specific project examples where you achieved challenging performance targets, scaled to meet demands, and ensured efficient resource utilization.

Include supporting metrics and data.

Can the Government provide a list of software and specific technologies that the contractor will be responsible for integrating?

More details will be provided as part of the RFP with the addition of a potential CUI level reading room. It will require DoD CAC/ECA and DoD email to access it.

Instructions will be provided as part of the RFP package. Detailed requirements will be provided for Task Orders with any applicable/ supporting core documentation.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

81 SOO 2.8.1 Test and Evaluation Master Plan (TEMP) and Testing Methodologies:

Describe your approach to developing and implementing a Test and Evaluation Master Plan (TEMP), specifying the testing methodologies and tools you will utilize. What type of testing is currently in use for this requirement?

See Amend. 1, Attachment 1, SPARTAN SOO_Rev 16 Sept 2025, Section 4.5.8.2.

changed from “Test and Evaluation Master Plan (TEMP)” to “Test and Evaluation Strategy (TES).”

The PMO has an overarching Test and Evaluation Strategy (TES) that encompasses contractor, developmental, operational, automated software pipeline testing, and cyber testing. The results of testing are used to gain approvals through Air Force operational acceptance, certificates to field, ATO, and fielding authorization(s).

IAW DODI 5000.87 DAFI 63-150, Air Force Supplemental to the Software Acquisition Pathway

82 RFI 2 Letter 2.8.2 Automated Testing for IDCS:

Describe specific automated testing tools and techniques you would use to improve test efficiency and coverage in IDCS.

Does the Government currently have automation for functional testing user experience (UX) for this requirement.

Has the Government already evaluated or is the Government already utilizing agentic testing?

No.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

83 RFI 2 Letter 2.8.2 Automated Testing for IDCS:

Describe specific automated testing tools and techniques you would use to improve test efficiency and coverage in IDCS.

Has the Government already evaluated or is the Government already utilizing agentic testing?

No.

84 RFI 2 Letter 2.11.1.2 SPARTAN SOO Implementation Strategy:

Describe your overall implementation strategy for meeting the objectives outlined in the SPARTAN SOO. How will you prioritize tasks and manage dependencies between different CAs? Provide a detailed and realistic implementation plan, including key milestones, dependencies, and risk mitigation strategies, justifying your prioritization.

Is there a list of existing programs or capabilities that currently provide the CAs that this solicitation anticipates incorporating in the initial period of performance?

The Government has not made a determination on CA structure but will inform potential vendors at a later date.

85 SOO

RFI 2 Letter

4.5.1 2.1

Capability Area Can you provide more details on the expected configuration and management of hybrid cloud infrastructure, especially in terms of security and resilience?

IL-5, IL-6, 99.9% availability in the cloud, all software is cloud native deployed in iron at each DAF base and in the GovCloud for C2 and management and central report.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

86 SOO 4.5.2 Capability Area Can you provide more details on the expected integration of Hardware-in-the-Loop (HIL) simulation environments for software testing?

The software development and deployment model is in a CI/CD environment that requires for rapid test and deliver to hardware and cloud environments. The E2E testing requires HIL to ensure containers are ready for productions prior to releasing to endpoint server stacks.

87 SOO 4.5.5 Capability Area What are the specific legacy DCO systems that need to be integrated with the IDCS, and what are the key challenges anticipated in this integration? Can the Government provide this information including IDCS architecture (e.g. DODAF views) and roadmap for planned modernization in a Bidder’s Library?

More details will be provided as part of the RFP with the addition of a potential CUI level reading room. It will require DoD CAC/ECA and DoD email to access it.

Instructions will be provided as part of the RFP package. Detailed requirements will be provided for Task Orders with any applicable/ supporting core documentation.

88 SOO 4.5.6 Capability Area Can you provide more details on the expected communication capabilities for DCO forces operating in DDIL conditions?

Communication capabilities will be aligned with a regional SOC concept with limited, degraded, or no connectivity off of the local base which includes future capabilities provided by the SDWAN provided by forthcoming Air Force infrastructure device modernization efforts focused on allowing bases to operate in a disconnected state.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

89 SOO 4.5.9 Capability Area What are the expectations for ongoing support and maintenance of the IDCS? Are there any specific service level agreements (SLAs) or support processes that need to be established? Would the service desk be required during core duty hours only or 24/7/365?

What geography (e.g. CONUS) does the service desk cover?

Cannot discuss or go into this subject at an unclassified open forum.

90 SOO 4.5.9 Capability Area What Service Desk and Service Management tools are deployed?

PMO/Operations Service Now, and Legacy Operations BMC Remedy.

91 SOO 4.5.3 Capability Area Are the current IDCS components under approved ATO/s? If so, is the ATO/s set to expire within 6 months of the anticipated award?

Yes and Yes

92 SOO 4.5.4 Capability Area Are the data sources referred to in the question related to internal or external sourcing? Is there an IDCS data architecture that can be shared via a Bidder’s Library?

Yes, the sources sought are internal to the platform, system generated such as telemetry, and external data such as logs, alert, metadata. More details will be provided as part of the RFP with the addition of a potential CUI level reading room. It will require DoD CAC/ECA and DoD email to access it. Instructions will be provided as part of the RFP package.

Detailed requirements will be provided for Task Orders with any applicable/ supporting core documentation.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

93 SOO 4.5.4 Capability Area What existing cybersecurity platforms, SIEMs (Security Information & Event Management), SOARs (Security Orchestration, Automation & Response) or EDRs (Endpoint Detection & Response) are deployed today? Will data management/analytics require managing this data? Are there APIs or data to access this data?

DEVO SIEM

SPLUNK SOAR

Deploying Elastic SIEM Deploying XSOAR SOAR

94 SOO 4.5.4 Capability Area Approximately how much raw security data (in GB/TB per day) is generated today, and what retention period is mandated?

More details will be provided as part of the RFP with the addition of a potential CUI level reading room. It will require DoD CAC/ECA and DoD email to access it.

Instructions will be provided as part of the RFP package. Detailed requirements will be provided for Task Orders with any applicable/ supporting core documentation.

95 SOO 4.5.4 Capability Area What security controls must be in place for any data science environment (e.g., encryption at rest/in transit, privileged access management, zero-trust networking)?

There will be a dedicated data science zone within the Systems Integration Lab (SIL) with the appropriate ATO and security controls. Also the Big Data Platform (BDP) is a data LakeHouse enabling Data science and data warehouse. Security controls are enable.

96 SOO 4.5.4 Capability Area What security level classification is the data (ex. IL4)?

At the level of the operational network hosting IDCS.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

97 SOO 4.5.4 Capability Area What are the expectations for ongoing support and maintenance of the IDCS? Are there any specific service level agreements (SLAs) or support processes that need to be established?

Generally the PMO supports tier 2 and tier 3 maintenance and SLAs support the base and operator level maintenance necessary for a global distribution of hardware.

98 SOO 4.5.4 Capability Area Is there an IDCS architecture and governance board to ensure that the IDCS function aligns with mission goals, manages risks, and delivers value efficiently while establishing control, promote consistency, seamless interoperability, and prevent technical and data sprawl, especially given enterprise-wide impact.

Yes there is an IDCS architecture governance board.

99 SOO 4.5.6 Capability Area What is the technology stack of the existing program focuses on protecting DoD networks from cyber threats?

More details will be provided as part of the RFP with the addition of a potential CUI level reading room. It will require DoD CAC/ECA and DoD email to access it.

Instructions will be provided as part of the RFP package. Detailed requirements will be provided for Task Orders with any applicable/ supporting core documentation.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

100 SOO 4.5.4 Capability Area How many different mobile and sensor platforms need to be integrated? Does IDCS need to integrate with systems outside of United states? How many potential users for the IDCS platform? Are they all CAC users or are some non-CAC users?

More details will be provided as part of the RFP with the addition of a potential CUI level reading room. It will require DoD CAC/ECA and DoD email to access it.

Instructions will be provided as part of the RFP package. Detailed requirements will be provided for Task Orders with any applicable/ supporting core documentation.

101 General General Industry Discussions Will there be an Industry Day or one-on-one sessions before RFP release?

The Government has not made any final decisions on whether draft RFP will be done.

102 General General IDIQ Award Will SPARTAN be competed as a single MAC IDIQ or will it be split into pools (e.g., large vs.

small business, capability area pools)?

See RFI 2 Letter, Section 1.2 The Defensive Cyber Systems Branch (AFLCMC/HNCD) is considering standing up a SPARTAN Multi-Award Contract (MAC) Indefinite-Quantity Indefinite- Delivery (IDIQ) contract and is conducting market research to identify potential sources. The results will assist the Government in deciding small or other than small businesses in each capability area.

103 SOO 6.3 Key Personnel Positions (KPPs)

How many KPPs are required at RFP submission? Will Letters of Commitment be required with the proposal?

KPP levels and guidelines (i.e. LoCs) will be shared at time of RFP release.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

104 SOO 2 Scope “As a System of Systems (SoS), a collection of independent systems that integrate to achieve a capability that none of the constituent systems could accomplish individually, the IDCS requires coordinated integration across multiple platforms, leveraging existing systems and incorporating new solutions with open standards and a hybrid cloud architecture.” Who is responsible for the RMF requirements, will it be the application owners or the successful contractor for this effort?

The awardee will be responsible under direction of the Government.

105 RFI 2 Letter 2.3.1 Zero Trust Architecture in a System of Systems (SoS) Environment

Can the Government provide high level Zero Trust Architecture requirements which must be met?

The Air Force has a ZT reference architecture and forthcoming ZT hardware, tools, and applications. IDCS must be interoperable and conformant to enterprise solutions for ZT which are not yet mature and are still traversing the acquisition and engineering process.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

106 Whitepaper Template

1.D vi. Technical & Security Capability

Will a cleared facility be required to participate in the solicitation response or is a cleared facility required after award?

Vendors will be required to have at a minimum SIPR facility clearance upon award of the IDIQ. It is not the Governments intent or responsibility to sponsor, or provide necessary cryptologic equipment to support IDCS. The vendors will have access to Government owned approved Systems Integration Lab (as space is available) and task order specific development environments.

If a vendor, does not have a facilities clearance, vendor must have the ability to operate within a cleared facility to preform work (and any associated agreements in place to prove facility access).

Any subsequent task order(s) that require a facility clearance, vendors must have that clearance to preform those task orders upon award.

107 General General Evaluation How will the Government evaluate innovation versus risk?

The Government will use a holistic evaluation process to assess vendor ability prior to IDIQ award and prior to task order award. Based on vendor approach and Government evaluation the most capable vendor will be selected for the specified work

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

108 General General Evaluation Will evaluation favor breadth (all CAs) or depth (specialized capability)?

If a vendor does not have experience in a particular area, it is not the IDCS PMO's expectation for vendors to populate CAs where they have little/no relevant experience. It is recommended that vendors primarily choose the capability/capabilities (CAs) where they believe they are most capable.

109 RFI 2 Letter 3.2 & 3.3 Documentation Marking and Proprietary Information

The question regarding conflicts of interest and vendor relationships is in both Section 1 and Section 3 of the response template. Please confirm that a response in Section 3 (in addition to Section 1) is only required if the company’s response is proprietary.

See Amend. 1, RFI 2 Letter SPARTAN_Rev 16 Sept 2025, Section 3.3 has been updated to Use of Non- Governmental Advisors.

Proprietary Information and Vendor relationships are two different things.

Proprietary information is information proprietary to a company, and a vendor might only want to share with Government employees. Vendor relationships, and in Section 3.3 Use of non-Government Advisors, is to inform potential offerors that the Government has non- Governmental advisory and assistance contractors that are working this effort. If there are any potential conflicts with the vendors in Table 2, and the potential offeror, please identify in your response.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

110 General N/A IDIQ Award How many IDIQ contract awardees are anticipated under the tentative multiple award contract construct? Additionally, will there be on-ramp opportunities at the IDIQ level during the MAC IDIQ period of performance?

The Government will inform potential offerors at a later date. Should it be in the Governments best interest, there will allow on-ramp opportunities at the IDIQ level during the MAC IDIQ period of performance?

111 General N/A Contract Type What is the anticipated contract type at the order level, such as Firm Fixed Price, Time & Materials / Labor Hour, or Cost Reimbursable? Will cost-type contracts be limited to specific Capability Areas?

The Government has not made any final decisions on contract type, however it is possible that the Government will consider multiple contract types on the IDIQ in order to support the effort outlined in Attachment 1 SPARTAN SOO, Section 2.

SCOPE.

112 Whitepaper Template

D.x. Contract Type Where in the response template should vendors provide feedback or recommendations on contract types for IDIQ orders?

See Amend. 1. Attachment 3. Rev.

SPARTAN Whitepaper Template, Section D.x. added a question, "What contract type/s is/are appropriate for this effort?

113 RFI 2 Letter 1.1 Joint ventures or teaming arrangements

Joint ventures or teaming arrangements are also encouraged.

If you propose a teaming arrangement, please clearly identify the roles and responsibilities of each team member in your response.

Can companies expect feedback in the way of suggested teamings based on RFI responses?

It's possible, however without know what the responses will be, it's difficult to make that determination at this time.

No.

Document / Attachment

Section / Paragraph # In reference to: Question/Comment Government Response

114 RFI 2 Letter 2.1.1 Integrating Cloud One and…