FA8307-26-R-CW02_QnA Responses_14May26.pdf
PDF 173 KB Posted
- Attached to
- Offensive Cyber Depot Operations & Sustainment
- Solicitation number
- FA8307-26-R-CW02
About this file
This is a Request for Information (RFI) Question Responses document for Air Force contract opportunity FA8307-26-R-CW02 that closed on 20 May 2026.
This is a follow-on requirement under incumbent contract FA8307-22-F-0030 requiring Tier 1, 2, and 3 support for complex information systems and Risk Management Framework/Authority to Operate (RMF/ATO) management. The requirement involves providing and operating an accredited, contractor-operated Sensitive Compartmented Information Facility (SCIF) in the San Antonio metropolitan area to support AF SCI access with workstations for at least 12 employees. The SCIF must meet DoD and Intelligence Community standards following ICD 705 and DoDM 5105.21-M-1 guidance, with final accreditation guidance provided in the solicitation. The contractor will serve as Site ISSO responsible for maintaining and adapting one active ATO (expiration February 2028) under one authorization boundary across three separate physical locations, reporting to a government ISSM. The Government is evaluating a cost-reimbursement contract structure under the Multiple Award Schedule (MAS) vehicle; however, the specific fee type (CPFF, CPIF, or CPAF) has not been finalized. The Government does not have a preferred IDIQ vehicle and will evaluate industry recommendations for existing DoD-accessible vehicles, potentially establishing a standalone contract if needed. Clearance requirements are TS/SCI, and all responses should be unclassified via email to the Contracting POC. The current objective is to award the follow-on contract by December 2026, with additional schedule details in the draft RFP. Small business determination is pending; if the acquisition proceeds unrestricted, large business offerors must submit a Small Business Subcontracting Plan per RFO 19.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| FA8307-26-R-CW02_QnA Responses_14May26.pdf | ||
| Offensive Cyber Depot Operations_ Sustainment RFI.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
FA8307-26-R-CW02
Request for Information (RFI)
Question Responses
Thank you for your interest and participation in the recent Request for Information (RFI).
Please find the answers to some of your submitted questions provided below.
Be advised that this RFI was conducted strictly for informational and market research purposes. Therefore, there will be no further communication from our office regarding this specific action. Please note that this individual action officially closes out on 20 May 2026.
1. Is this a new requirement, or is there an incumbent contract/contractor currently performing the same or similar work? If an incumbent exists, could you provide the contract number and vendor’s name?
This is not a new requirement; there is an incumbent contractor performing the effort under Contract FA8307-22-F-0030.
2. What are the clearance requirements? I
TS/SCI
3. Can you tell me if this is new work or if it is a follow-on contract requirement?
Follow on contract.
4. We would like to know if classified responses will be allowed and if so, what email address to use in replying so.
For now, all responses should be unclassified and through the Contracting POC.
5. Can you please clarify when the RFI is due, and if that date includes the White Paper &
ROM?
RFI is due 20 May 2026
6. Should vendor capability statements and ROMs be marked as CUI if they contain information responsive to the CUI-marked requirements?
Yes, all information should be marked accordingly.
7. What is the required transmission method for submissions — unclassified email, SAFE, or another secure channel?
Unclassified email to the Contracting office POC.
8. Could you please provide the current contract number for the effort that is presently being performed?
Contract FA8307-22-F-0030.
9. With respect to the SCIF space requirement referenced in the RFI, could you provide additional details regarding:
o The anticipated size or capacity requirements
Scope from the current CWMS PWS asks for AF SCI access and to provide workstations for at least 12 employees.
o Accreditation expectations and whether the space must be government-accredited
Scope from the current CWMS PWS calls for just “an accredited, contractor-operated SCIF”.
10. From a location standpoint, are performance locations limited to the JBSA-Lackland area, or would alternative locations be considered?
Scope from the current CWMS PWS calls for a “SCIF in the San Antonio metropolitan area”, so doesn’t necessarily need to be in the JBSA-Lackland area. Though it would help as the systems they support are all on prem at Lackland or San Antonio Port.
11. Are there any additional insights you are able to share regarding the anticipated acquisition timeline or procurement strategy for this requirement?
The Government is still refining the acquisition timeline. While planning is ongoing, the current objective is to award the follow-on contract by December 2026. Additional schedule details will be provided in the draft RFP as the acquisition strategy is finalized.
12. During our conversation, you mentioned that the effort is likely a follow-on of an existing contract. Could you provide the vendor or contract ID for that incumbent contract?
Contract FA8307-22-F-0030.
13. Contract Type and Fee Structure
The RFI references "Cost Plus operations and sustainment activities" but does not specify the fee type. Will the follow-on contract be structured as Cost Plus Fixed Fee (CPFF), Cost Plus Award Fee (CPAF), or Cost Plus Incentive Fee (CPIF)? Additionally, will DCAA accounting system approval be a mandatory responsibility determination for offerors, or will the government accept an offeror's written assertion of adequate accounting system pending formal audit?
The Government is evaluating the use of a cost-reimbursement contract structure under the MAS vehicle; however, the specific fee type (e.g., CPFF, CPIF, CPAF) has not been finalized. The final contract type will be identified in the draft RFP following completion of market research and acquisition planning.
14. IDIQ Vehicle Specificity
The RFI states the government prefers vendors recommend an existing DoD-accessible IDIQ vehicle. Does AFLCMC/HNCO have a preferred or currently used IDIQ vehicle for this or similar efforts and if so, what is the contract name and number? Alternatively, will the government consider establishing a new standalone contract vehicle if no existing IDIQ adequately covers the scope?
The Government does not have a predetermined or preferred IDIQ vehicle for this requirement. As stated in the RFI, we are seeking industry recommendations on existing DoD-accessible vehicles that may be suitable. All suggested vehicles will be evaluated during acquisition planning.
If market research indicates that no existing IDIQ adequately covers the scope, the Government may consider a standalone contract. Any decision will be finalized and communicated in the draft RFP.
15. SCIF Accreditation Standards and Government Support
The RFI requires the contractor to provide and operate a SCIF in the San Antonio metropolitan area with connected AFSCI terminals. What specific accreditation authority and standard governs the required contractor SCIF; ICD 705, DoD Manual 5105.21, an AF-specific directive, or a combination? Will the government provide the applicable technical specifications for AFSCI terminal connectivity requirements?
The contractor-provided SCIF must meet applicable DoD and IC standards. The Government anticipates accreditation will follow ICD 705 and DoDM 5105.21-M-1, along with any AF-specific SCI security directives. Final accreditation guidance will be provided in the solicitation.
The Government will also provide the required AFSCI terminal connectivity specifications and security requirements in the draft RFP or accompanying classified attachments, released only to appropriately cleared offerors.
16. Depot Work Scope and ATO Ownership
The RFI describes Tier 1, 2, and 3 support for complex information systems and RMF/ATO management. Please clarify the boundary of contractor ATO responsibility:
(a) Will the contractor serve as the Authorizing Official's designated representative responsible for maintaining ATO status, or will a government ISSM retain that role with the contractor in a support capacity?
The contractor will be the Site ISSO for the site with a government ISSM that they would report to. The contractor ISSO will be responsible for maintaining and adapting the currently active ATO going forward and for future features added to the system.
(b) Approximately how many discrete information systems or authorization boundaries will the depot contractor be responsible for maintaining?
One information system/authorization boundary all under one ATO, but with three separate physical locations.
(c) Are these systems currently under active ATO, or will some require initial authorization as part of the depot standup?
The information system is currently under an active ATO that has a current expiration of Feb 2028.
17. Acquisition Strategy and Small Business Consideration
The RFI was published with no set-aside designation. Has AFLCMC/HNCO completed a small business market research determination for this requirement, and if so, what was the finding? (b) Would the government consider a small business set-aside strategy? If the acquisition proceeds unrestricted, will there be a small business subcontracting plan requirement?
The Government has not yet completed a final small business determination for this requirement. Market research is ongoing, and no set-aside decision has been made at this stage. The Government will consider a small business set-aside strategy if market research supports it. If the acquisition proceeds on an unrestricted basis, a Small Business Subcontracting Plan will be required from large business offerors in accordance with RFO 19.
File details come from the government source that posted it. Updated .