Hydra CSO Call FINAL Rev.2.docx

OVERVIEW

This Commercial Solutions Opening (CSO) Call solicitation is issued in accordance with 10 USC 3458 and DoD Class Deviation 2022-O0007 “Defense Commercial Solutions Opening”

NAICS Code and associated description: 518210

Federal Agency Name and Contracting Officer: Department of Air Force (DAF) Air Force Life Cycle Management Center (AFLCMC), Neal Duiker, neal.duiker@us.af.mil

Commercial Solutions Opening Title: This is a combined synopsis/solicitation: Commercial Services Offering (CSO) – AFLCMC Data Operation CSO, Closed, One-Step, titled “Project Hydra - CSO Call 6”

Commercial Solutions Opening Number: FA8600-23-S-C056

Commercial Solutions Opening Type: This is the initial announcement under Call 6. This will be a One-Step Call solicitation.

PROPOSAL DUE DATE AND TIME: Proposals will be accepted until 18 November 2024 at 1700 ET. Proposals may be submitted at any time during this period. Proposals received after specified date and time will be considered late in accordance with FAR 52.212-1(f). Interested Vendors can submit clarifying questions to AFLCMC by 25 October 2024. AFLCMC will publish all received questions and AFLCMC’s responses (anticipated 1 November 2024). All submissions (questions and proposals) shall be made to the designated Submission POCs below.

Submission POC: Proposals must be submitted via email to the Contracting Points of Contact (POCs):

Contracting Officer Name: Neal Duiker Email: neal.duiker@us.af.mil

Contract Specialist Name: Cameron Hunter Email: cameron.hunter.5@us.af.mil

FULL TEXT – CALL 6

( Project Hydra)

Overview

This Commercial Services Opening (CSO) Call is intended to be as streamlined as possible to allow for the exploration of modern solutions to support a variety of critical national security systems. Air Force Life Cycle Management Center (AFLCMC) invites vendors to submit innovative and novel technical solutions which address all aspects of Digital Infrastructure (DI), focusing on the user story focus areas below. This requires delivering an enduring, secure, robust, efficient, responsive, agile, elastic and extensible DI solution spanning all classification levels.

This AFLCMC project operates in high classification environments; specifically this project requires vendors cleared to Secret, Top Secret including (collateral, Sensitive Compartmentalized Information (SCI), and Special Access Program(SAP)). To be eligible for any contract/instrument award, vendors must be cleared to workin all highly classified environments at the time of proposal submission. If vendor intends to perform classified work at their facility (or subcontractor or sub-awardee’s facility), they will need to provide a Facility Accreditation Letter (FAL) for each facility to the Contracting Officer/Agreements Officer by no later than (NLT) contract award (anticipated December 2024/January 2025).

This CSO Call may result in the award of a FAR-based contract, an Other Transaction Agreement (OTA) under 10 USC 4021, or an Other Transaction for Prototype Project pursuant to 10 USC 4022. AFLCMC intends to follow the processes identified in the Data Operations CSO unless otherwise noted or annotated in this Call. AFLCMC is not obligated to make any awards as a result of this Call and all awards are explicitly subject to the availability of funds and successful negotiations. The Government is not responsible for any monies expended by any vendor prior to the issuance of any awarded contract/agreement.

AFLCMC reserves the right to modify the solicitation requirements of this CSO Call at its’ sole discretion.

Digital Infrastructure (DI) Technology Focus Areas

General Information: AFLCMC designed an Azure cloud-based software DevSecOps environment supporting multiple USAF programs (hereafter referred to as Crucible). The Crucible environment contains cloud resources at the IL5 (Controlled Unclassified Information), IL6 (Secret) and IL6+ (Secret Special Access Program) classifications. Current and legacy software was not developed for this new cloud architecture approach. Existing software development efforts will require a shift in architecture and implementation, to optimally utilize Crucible and the benefits a hybrid-cloud architecture has to offer. AFLCMC desires to leverage a hybrid-cloud model in future software development with an emphasis on containerized web applications that provide Single-Sign On for users across a suite of software. The hyperscale initiative, or Hydra, is an effort to assess existing software products and execute the necessary refactorization work to achieve AFLCMCs new approach, while maintaining the core functionality of the software. Many of the software applications being targeted for this effort require the ability to be instantiated on premises in a hybrid-cloud fashion should the edge lose hyper-scale connectivity. AFLCMC currently has multiple software applications that have been identified as in need of the hyperscale initiative today with plans to transition more applications over the next few years. Software products range from complex, sophisticated software to simple. AFLCMC’s singular requirement is divided into three separate requirements: Software Assessment, Software Refactor, and Software Integration and Support. AFLCMC intends that any awarded vendor would be continuously delivering new applications for analysis and possible refactoring during the PoP. Each new application will be its own procurement for the purposes of billing and personnel management.

1. Software Assessment Requirements A. Scope The vendor is expected to provide a comprehensive cloud software assessment to determine the government cloud deployment viability and cloud refactor potential of government-provided software. The assessment should focus on transitioning software to containerized, web-based applications that leverage Single Sign-On (SSO) services for end users. As part of the proposal, the vendor should provide a repeatable cloud software assessment framework that may include documentation, tooling, and deployment of tooling in the government cloud environment. Vendors should assume that the USG will provide source code and accompanying documentation that the USG has in its possession as GFE. Using this source code and accompanying documentation, the vendor shall use their cloud software assessment framework to analyze the software and produce a software assessment that addresses at a minimum:

· Re-use of existing code for both business logic and application logic

· Standardized software complexity metrics including lines of code and cyclomatic complexity

· Software changes to enable optimal hyperscale utilization such as new APIs, software design patterns, and containerization

· Software changes to convert client-side applications to web-based applications leveraging SSO.

· Re-work necessary to implement recommended software changes

· Recommendations for cloud services to enable the hyperscale initiative that do not currently exist in government environment

· Incorporation of additional government requested APIs to the software provided as GFI

· An itemized price guide encompassing follow-on software refactor work Depending on the application’s use, the USG may provide additional scope to the hybrid cloud deployment requirements. As such, the cloud assessment framework should be customizable to include the following deployment scenarios:

· Hyperscale enclave deployment

· Hybrid hyperscale-edge deployment

· Edge Node deployment

B. Deliverables:

AFLCMC requires vendors to deliver the following products in the performance of this task:

i. Repeatable software assessment framework: Vendors shall deliver a detailed software assessment framework used in analyzing all GFE provided applications and software documentation. This includes identification of a detailed listing of the methods and tools used to conduct the analysis. All tools and analysis is subject to security and cybersecurity restrictions as determined by AFLCMC.

ii. Software Assessment Documentation: Vendors shall deliver comprehensive software/application assessment report detailing findings and recommendations on the possible refactor of the application/software into a cloud native, containerized web application. Based on the findings of the software/application assessment, AFLCMC will make a go/no go determination on whether application should be refactored under task 3.

iii. Weekly update Meetings: Vendors shall have a mechanism to track and report progress on each application/software assessment. AFLCMC prefers live program management dashboards such as Jira/Confluence to give real-time status.

iv. Final software assessment outbrief: Vendors shall provide and deliver an outbrief to key AFLCMC personnel on findings from each software/application assessment.

2. Software Refactor Requirements A. Scope Following the comprehensive software assessment, the USG will decide whether to implement the Software Assessment recommendations for software refactor. AFLCMC is utilizing Azure cloud for its cloud solutions. Therefore, AFLCMC requires vendors to identify previous experience developing applications in and for Azure environments. Additionally, it is required that the vendor have the credentialed personnel to operate in a TS//SAR environment at award.

The vendor is expected to continuously deliver and deploy the software refactor artifacts within the USG’s Azure cloud environment on a two-week sprint cadence. As such, the vendor is required to provide tooling and environment requirements to the USG. The vendor will work with the USG to find suitable replacement options if desired tooling is not deployable in the environment. The vendor is expected to host weekly meetings with the USG to provide updates, feedback, and blockers for the software refactor. The vendor shall work with USG appointed integration partners to validate software meets functional and non-functional requirements, including but limited to operability, security, and availability. All source code to build, and automatically configure and deploy the application, software documentation and all other software artifacts will be delivered to and remain within the government cloud environment. All data rights restrictions, if any, shall be known prior to work beginning in the cloud environment. Source code documentation should include at a minimum:

· Code description documentation in Markdown or similar format

· Software models detailing software paradigms, defined functions, defined services, etc.

· Implementation and deployment documentation including how-to manuals and troubleshooting guide

· Machine readable API documentation As part of this service, the vendor is expected to provide a standardized software paradigm for hybrid cloud deployment. This includes providing a repeatable, standardized software model that can be applied to new applications to create a cohesive ecosystem for current and future development efforts.

B. Deliverables - AFLCMC requires vendors to deliver the following products in the performance of this task:

iii. Initial Delivery and Continuous delivery of all source code, build code, deployment code and documentation necessary to build, compile, and run the application in the environment.

3. Software Integration and Technical Support A. Scope Upon delivery of the refactored application and documentation, AFLCMC may need the expertise of the vendor to re-integrate the new application into existing systems. As such, AFLCMC requires the availability of personnel to support integration of the new application. This support may include, but is not limited to:

· Working with AFLCMC system integrators to deploy the new application in existing systems

· Attend technical interchange meetings

· Present demonstrations of the refactored software application

· Provide support for software test and validation activities performed by AFLCMC system integrators Additionally, the vendor is expected to provide technical support for any issue related to the software application deployment or which impacts the application’s use that, based on government assessment, is directly attributable to the software application for the first year after its initial deployment into the system. The vendor shall provide a support personnel management plan for integration and technical support efforts that cover the scope described above to include personnel duty descriptions.

B. Deliverables

i. Support Personnel Management Plan for integration and technical support efforts Focus Areas Sought: Application Development + application refactoring for cloud deployment, Continuous Integration (CI)/Continuous Development (CD) software pipeline, Existing capability refactoring/integration for Application Programming Interface (API) microservice architecture, Cloud Native Design, and Zero-Trust Architecture

Anticipated Delivery Date: 5 years

1. Call Description, Instructions to Vendors, and Evaluation Criteria

Overview: This call will be a one-step call. Proposals may be submitted at any time prior to the due date and time specified in this Call. Vendors are responsible for monitoring SAM.gov for any amendments to this Call that may have updated information. Proposals will be evaluated against the criteria detailed below.

Proposal due date and time is 18 November 2024 at 1700 ET. AFLCMC will review Proposals based on the below evaluation criteria. Interested Vendors can submit clarifying questions to AFLCMC by 25 October 2024. AFLCMC will publish all received questions and AFLCMC’s responses (anticipated 1 November 2024). AFLCMC, at its sole discretion, reserves the right to request a presentation or discussion with Government personnel about the submitted Proposal.

Overarching Instructions: AFLCMC reserves the right to award to multiple different vendors, a single vendor, or not make any award at all. As a reminder, responses must be UNCLASSIFIED. AFLCMC will not accept classified proposals under this Call.

PROPOSAL INSTRUCTIONS: Below is the required structure and required content for proposal submission for this Call. Vendor responses shall be submitted to Mr. Neal Duiker, at neal.duiker@us.af.mil & Mr. Cameron Hunter, at cameron.hunter.5@us.af.mil, NLT 1700 (ET) on 18 November 2024 via email in either PDF, Word, or PowerPoint file types and shall include the following:

Part 1 - Cover Page: Vendor’s cover page must include the following information:

Vendor Name Vendor Address Vendor technical, programmatic, and contracts points of contact (PoC) List whether your organization qualifies as any of the following in accordance with FAR Part 19: Small Business (SB), Small Disadvantaged Business (SDB), Woman-Owned Small Business (WOSB), HUBZone Small Business, Veteran-Owned Business, Service-Disabled Veteran Owned Small Business (SDVOSB), Historically Black College or University (HBCU) and Minority Institution DD254 Info CAGE Code Cognizant Security Office Name Address Phone Number

Part 2 - Questionnaire Responses: Vendors shall address all the following:

Provide a list of general classification levels and additionally proscribed categories from the below options that your organization has utilized for past projects. (UNCLASSIFIED / CUI / SECRET / SECRET SAR / TOP SECRET/ TOP SECRET SAR / TOP SECRET SCI) Note: Do not provide any classified information regarding past projects on your technical proposal submission, to include contract/agreement numbers (PIIDs).

Does your organization have experience with Microsoft Azure? Y/N

Has your software been evaluated or accredited for use in government IL5, IL6, or IL6+? (Provide an example for each classification)

Part 3 - User Story Response(s): Independent from the above responses, a vendor shall submit a proposal addressing the following criteria:

a. Vendor proposals shall not exceed twelve (12) pages (Times New Roman, 12 pt font).

b. Description of suggested technical solution, including a definition of methodologies used to conduct software assessment, refractor, and integration and technical support requirements. Also describe timeframes for completing these requirements.

c. Description of capacity for software assessments and refactoring, specifically indicating ability to scale based on AFLCMC needs.

d. Pricing model based on complexities of software. Note: AFLCMC is looking for ability to assess and refactor multiple varying software products over the five-year period of time. Pricing models shall contemplate these requirements.

e. One or multiple examples of experience related to the user story/focus area (Demonstrated experience with highly secured IT systems, classified networks, and/or special access programs is preferred).

f. Any ground rules/assumptions on which your solution is based.

Proposals received in response to the CSO shall be evaluated in accordance with evaluation factors specified below using a scientific, technological, or other subject-matter expert peer review process.

PROPOSAL REVIEW, EVALUATION AND SELECTION PROCESS:

Each proposal will be evaluated by the Government and stand on its own technical merit. Proposals will be evaluated in accordance with the following evaluation criteria. For the Security and Azure Experience factors will be evaluated first. Any vendor failing to meet one or both of these requirements will not be evaluated further. The Government will review the remaining factors (experience, technical and price) to determine if it has the potential to meet AFLCMC’s needs based on the below criteria, which are listed in equal importance.

Security: Does the vendor have the requisite security clearances (facility and personnel) to perform the services? AFLCMC work requires performance within IL5, IL6 and IL6+ environments. Failure to meet security requirements upon Proposal submission will constitute sufficient justification to exclude the proposal from further consideration. Vendors are required to provide DCSA issued FCL and NIST compliance documentation.

Azure Expertise: Does the vendor have sufficient expertise using Azure cloud, Azure Stack Hubs, Azure services with both commercial and government enrollments, Azure Access Points, and/or Azure Virtual Desktops?

Experience: Has the vendor demonstrated experience in providing like or similar services in hybrid cloud IL5, IL6 and IL6+ classified environments/enclaves? The vendor must provide at least one example of software that they have developed/refactored and has been approved for deployment in an IL6 environment or higher. Awardable vendors must demonstrate relevant experience working in highly secure environments. Failure to meet this requirement upon proposal submission will constitute sufficient justification to exclude the proposal from further consideration.

Technical: Do the services and offered solutions meet the needs of AFLCMC as outlined in the Call? AFLCMC will prefer solutions offering the greatest benefit regarding experience, scaling and capacity, past performance, and turnaround times. USG will evaluate final solutions on the following criteria:

a. Does the proposed solution address all three of the tasks outlined in the acquisition objectives?

b. Does the vendor’s solution provide a repeatable, standardized software assessment framework to perform software evaluations? Is the solution automated to the maximum extent possible? Does the vendor’s assessment cover all required components outlined?

c. The USG desires a standardized software paradigm for hybrid cloud deployment. Does the vendor’s solution provide a repeatable, standardized software model that can be applied to new applications?

d. Does the vendor’s solution include machine readable documentation where applicable?

e. Does the vendor’s solution define a CI/CD strategy for delivery and test into the USG hybrid cloud environment to include necessary tooling?

f. Does the vendor have the necessary training and experience customizing Azure applications, environments, tools, etc to perform the outlined tasks? Does the vendor have relevant past experience providing like or similar services in highly secure environments? The Government in its sole discretion reserves the right to also consider the vendor's past performance on other efforts.

g. Does the vendor’s solution incorporate security verifications for software deployed in classified environments?

h. Does the vendor describe a process for software conversion to web-based applications?

Price: The proposed price will be evaluated for reasonableness.

AFLCMC will review the final price proposal in relation to both the scope of work proposed by the final solution and the independent government estimate. AFLCMC will use DFARS 212.209 as guidance in evaluating price.

a. Interested vendors are required to provide a fixed price methodology for their solution brief to include cost variance based on application complexity: simple, moderate, and complex. Vendors should align their complexity to number of lines of code and cyclomatic complexity and indicate those metric values. The vendor should include any additional assumptions made for complexity in their pricing methods.

No other criteria will be used.

Using the evaluation criteria, the Government will select proposals for award that best meet the Government’s needs. Selected offerors will be invited to enter into negotiations for either a fixed price FAR 12 contract or an OTA. The selection of one or more sources for award will be based on the Government’s evaluation and funding availability. NOTE: The Government reserves the right to award all, some, one, or none of the proposals.

If a vendor is determined to be awardable and chooses to proceed to contract/agreement award, AFLCMC and the vendor will enter into contract/agreement negotiations. Prior to award of a contract/agreement, the Contracting Officer/Agreements Officer will make a price reasonableness determination.

DEBRIEFINGS:

For unsuccessful vendors, the Government will conduct written, post-award debriefings upon request in accordance with FAR 52.212-1(l) and this Call. Debriefings will address the evaluation factors contained herein only. Debriefings will not include a comparison of submissions.

ADDITIONAL INFORMATION:

This CSO Call may result in the award of a FAR Part 12 contract or an Other Transaction Agreement (OTA) under 10 USC 4022 (also referred to as an Other Transition for Prototype or OTP). The awarded contract type shall be either Firm Fixed Price (FFP) or Fixed Price Incentive (FPI) in accordance with FAR Part 12.

The Government will be the sole decision authority on whether to pursue a FAR Part 12 Contract, an OTA, or no award at all. The Government reserves the right to award some, all, or none of the proposals received in response to this Call based on mission requirements and the availability of Government funds. The Contracting/Agreements Officer reserves the right to negotiate directly with the vendor on the terms and conditions prior to execution of the resulting contract/agreement on behalf of the Government. Be advised that only a Contracting/Agreements Officer has the authority to enter into, or modify, a binding contract/agreement on behalf of the United States Government.

This Call could result in the potential award of a follow-on production or solution integration contract or OTA.

Vendors must possess all required personnel security clearances, facility clearances, and other infrastructure requirements necessary to perform any proposed classified work in accordance with a Contract Security Classification Specification (DD Form 254) without reliance on Government resources. If vendor intends to perform classified work at their facility (or subcontractor or sub-awardee’s facility), they will need to provide a Facility Accreditation Letter (FAL) for each facility to the Contracting Officer/Agreements Officer by proposal submission.

DFARS 252.239-7017 - NOTICE OF SUPPLY CHAIN RISK (DEC 2022):

(a) Definitions. “Supply chain risk,” as used in this provision, means the risk that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert the design, integrity, manufacturing, production, distribution, installation, operation, or maintenance of a covered system so as to surveil, deny, disrupt, or otherwise degrade the function, use, or operation of such system (10 U.S.C. 3252).

(b) In order to manage supply chain risk, the Government may use the authorities provided by section 10 U.S.C. 3252. In exercising these authorities, the Government may consider information, public and non-public, including all-source intelligence, relating to a vendor and its supply chain.

(c) If the Government exercises the authority provided in 10 U.S.C. 3252 to limit disclosure of information, no action undertaken by the Government under such authority shall be subject to review in a bid protest before the Government Accountability Office or in any Federal court.

Proprietary Information: Information constituting a trade secret, commercial or financial information, confidential personal information, or data affecting national security must be clearly marked. It shall be treated in confidence to the extent permitted by law. This restriction does not limit the Government’s right to use information contained if it is obtained from another source without restriction. AFLCMC assumes no liability for disclosure or use of unmarked data and may use or disclose such data for any purpose. If a vendor is awarded a contract as a result of or in connection with the submission of proprietary data in the proposal, the Government shall have the right to duplicate, use or disclose the data to the extent provided in the resulting contract/agreement.

Proposals containing data that is not to be disclosed to the public for any purpose or used by the Government except for evaluation purposes shall include the following legend on the cover page:

“This proposal includes data that shall not be disclosed outside the Government and supporting personnel and shall not be duplicated, used or disclosed—in whole or in part – for any purpose other than to evaluate this proposal. If, however, a contract is awarded to this vendor as a result of – or in connection with – the submission of this data, the Government shall have the right to duplicate, use, or disclose the data to the extent provided in the resulting contract. This restriction does not limit the Government’s right to use information contained in this data if it is obtained from another source without restriction. The data subject to this restriction are contain in sheets [insert numbers or other identification of sheets].”

Each restricted data sheet should be marked as follows:

Use or disclose of data contained on this sheet is subject to the restriction on the title page of this proposal.

Data Rights: All proposal submissions shall include Data Rights Assertions, if applicable. This will be an essential element of each proposal submission. Special Licensing Agreements may be negotiated upon request. AFLCMC reserves the right to negotiate data rights as part of the Contracting/Agreement process.

Export-Controlled Items: Depending on the proposal subject matter, an awarded contract may be subject to Export Control (International Traffic in Arms (ITAR) 22 CFR 120-131, or Export Administration Regulations (EAR) 15 CFR 710-774). If the effort is subject to export controls, then a Certified DD Form 2345, Military Critical Technical Data Agreement, will be required to be submitted with proposals. DFARS 252.225-7048, “Export Controlled Item (JUN 2013)” clause shall be contained in all resulting contracts.

Supplier Performance Risk System (SPRS): In order to receive a DoD Contract, every vendor will be required to perform a Basis NIST SP 800-171 DoD Assessment. That process is described here. Once the Basic NIST 800-171 DoD Assessment is complete, each vendor will need to follow the instructions contained within this page to enter the results in SPRP on the PIEE website.

Telecommunications: All OTAs or contracts awarded under this Call will contain prohibitions on the use of certain telecommunications devices in accordance with DFARS 52.204-25.

Eligible Vendor: This is an unrestricted solicitation and open to all vendors. Small businesses are encouraged to propose. Vendors are encouraged to complete the Annual Representations and Certification in the System for Award Management (SAM) as soon as possible.

You may be ineligible for award if all requirements of this solicitation are not met in the Proposal (when applicable).