SBC Cybersecure Enclave SOO - v20260806.docx

CUI

CUI

Statement of Objectives (SOO) Small Business Cybersecure Enclave Project Description: Pilot and Field Test of Affordable Secure Enclave Solutions for DAF-Furnished CUI Protection in Small Business Contracts Date: TBD Preparing Organization: HQ AFTC / AFWERX

1.0 Purpose

The purpose of this Statement of Objectives (SOO) is to obtain contractor support to develop and demonstrate a secure platform that enables the Department of the Air Force (DAF) to furnish small business (SB) contractors with compliant environments for handling Controlled Unclassified Information (CUI). This effort will provide the DAF with a scalable, cost-effective solution that enhances the level of cybersecurity protection and reduces the associated burden on small businesses by shifting responsibility for CUI protection to DAF-managed systems, ensuring mission readiness and operational superiority against advanced persistent threats (APT).

2.0 Background

The DAF relies heavily on SB innovation to advance critical technologies. Currently, SB contractors are required to implement NIST SP 800-171 to fulfill DFARS 252.204-7012.

Current Limitations: Implementing NIST SP 800-171 requires dedicated cybersecurity professionals costing $150K+ annually, with Cybersecurity Maturity Model Certification (CMMC) regulations adding additional assessment costs. Over 80% of DAF SB contractors have fewer than 20 employees and cannot protect DAF/DoW CUI in a sustainable model. No certified COTS solutions exist that affordably bridge this gap, exposing critical innovations to vulnerabilities and supply chain risks.

Mission Need: A transition to DAF-furnished secure enclaves is required immediately to counter advanced persistent threats, particularly stealthy cyber espionage from state-sponsored actors targeting small defense innovators. The need is increasing exponentially due to the emergence of threats employing Artificial Intelligence that can rapidly identify and exploit vulnerabilities.

3.0 Scope

This acquisition encompasses the design, development, prototyping, and field testing of affordable secure enclave solutions applicable to small business environments.

· In Scope:

· Provide a scalable architecture design, hardware, and software (system and application) that meet NIST SP 800-53 (171/172) requirements and can obtain an Authority to Operate (ATO).

· Provide a holistic Life-cycle Support Plan for the enclave solution to be executed by the developing contractor, the government office overseeing the follow-on program of record, and the SB contractor customer base. Include compliance requirements, security training and procedures, and sustainment measures necessary for continuing protection of CUI.

· Provide a Service Provider Plan that includes next business day service, Managed Service Provider (MSP), Managed Security Service Provider (MSSP), hardware, and licensing costs. Services provided include customer support, security patching, multi-stage backup (onsite warm / offsite cold), multi-zone network security reference architecture, DAF Chief Information Security Officer (CISO) monthly sessions, and audit representation.

· Field test the solution in a limited number of SB programs identified by the government.

· Provide a Lessons Learned report describing the findings from field testing of the solution.

· Provide a manufacturing and service scale-up plan to support government purchase and fielding of up to 500 systems per year Target Audience/Users: SB contractors in the Defense Industrial Base (DIB) - to include those under contract via the AFWERX SBIR/STTR program, directly contracted by other DAF/Department of War (DoW) organizations, and subcontractors to defense firms - that involve CUI.

Possible Other Users: Academic institutions performing under US government grants; foreign contractors providing services to US government agencies operating overseas; non-military government agencies requiring cybersecurity protection of their data beyond that available or affordable by their contractors.

4.0 Period and Place of Performance

Base Period: 12 months Option Periods: 2 x 6 months for additional field tests and/or additional use case assessment Primary Location(s): TBD Travel Requirements: TBD

5.0 Performance Objectives (Required Results)

The contractor shall propose a comprehensive solution (in the form of a Performance Work Statement) that meets the requirements for a DAF enclave and the requirements for incorporation into the DAF software registry.

1. Requirements for a DAF Enclave (ATO & ATC) To operate on a DAF network, a system must prove that it can adequately protect confidentiality, integrity, and availability in accordance with AFI 17-101 (Risk Management Framework for Air Force IT).

· Risk Management Framework (RMF): The system must implement and validate security controls based on NIST SP 800-53. The baseline controls are determined by the system's categorization (Confidentiality, Integrity, and Availability impact levels).

· Authority to Operate (ATO): An Authorizing Official (AO) must formally accept the risk of operating the system. An ATO is typically valid for three years, or until a major system change occurs, provided the system maintains continuous monitoring.

· Approval to Connect (ATC): Having an ATO does not automatically grant network access. The system must also obtain an ATC from the enclave owner (e.g., the AF Enterprise AO) which is a formal evaluation of the risk of connecting the system to the receiving network.

· Required Artifacts: The program office or system owner must generate a comprehensive body of evidence, which typically includes:

· System Security Plan (SSP)

· Security Assessment Report (SAR)

· Plan of Action and Milestones (POA&M) for unmitigated vulnerabilities

· Hardware and Software lists with associated STIG (Security Technical Implementation Guide) checklists

· Network Topology and Data-Flow Diagrams

· Incident Management and Disaster Recovery Plans

2. Requirements for the DAF Software Registry (AF E/APL) In accordance with AFMAN 17-1203, only software listed on an approved products list—such as the Air Force Evaluated/Approved Products List (E/APL)—may be installed on DAF networks.

Getting software onto the AF E/APL is generally handled through the Software Assessment and Certification (SACA) process managed by the Air Force Network Integration Center (AFNIC).

· SACA Process: AFNIC assesses desktop, server, web, and mobile software for security, supportability, and compatibility within the Realistic AFNET Validation Environment (RAVE).

· Sponsorship: Software must have a government sponsor (an AF community that will use the system) who submits the Application Request Worksheet (ARW).

· Required Artifacts for Assessment: The sponsor must submit:

· Application Request Worksheet (ARW)

· RAVE User Agreement

· Installation Guide

· System/Network Topology (SV-2)

· Sponsor-developed Application Systems Requirements documents

· Security Testing: The software undergoes functional and security testing (including packet captures, malware checks, and vulnerability scanning using tools like AppScan) to ensure it poses a low risk to the network. Any identified vulnerabilities must be mitigated or accepted.

· Exclusions (What CANNOT be approved): Certain software will be automatically rejected from the SACA process, including:

· Software without a vendor or sponsor responsible for developing security patches.

· Software with unmitigable Moderate (CAT II) or High vulnerabilities.

· Unsupported freeware, shareware, or Open-Source Software (OSS) with no configuration/software support plan.

· Software using ports, protocols, or services not listed in the DoD Category Assurance List.

6.0 Use Cases

The contractor shall develop solutions that meet the needs of some or all the use cases below.

1. Software Developer

Alfa Software Development is a firm with five full-time employees and 10 independent subcontractors. The firm specializes in software solutions for both commercial and government clients. Currently, the firm's contracts and revenue include a mix of efforts direct with DoW, some as a defense subcontractor, and the remainder commercial. Defense contracts include CUI. Alfa requires a virtual/physical enclave to do all their government work which involves coding and CUI storage while using their commercial devices for their non-DoD business. The firm must manage a unique workforce structure, which includes a mix of full-time employees and independent contractors that work across offices, field and home locations.

2. Embedded Software Developer Bravo Company has 20 full-time employees and five independent subcontractors. The firm specializes in both software and hardware development for government and commercial clients. The company’s product line primarily involves COTS hardware upgraded/modified and programmed with its software. Currently, the firm's contracts and revenue are a mix of direct with DoW and commercial. One of the firm's limiting factors is the sourcing of their complex supply chains because they both develop and leverage commercially developed software/hardware. Like Alfa, Bravo requires a virtual/physical enclave to do all their government work, to include design, coding, and CUI storage while using their commercial devices for their non-DoD business.

3. Scientific R&D Charlie LLC is a Small Business Innovation Research (SBIR) firm focused primarily on DoW needs. The firm's six organic employees, two independent subcontractors, and two student interns use research facilities and resources in the owner’s garage and at a university. Charlie’s revenue is 80% DoW and 20% from investor funding. The company performs modeling and simulation, design, instrumented model fabrication, as well as experimentation in laboratory environments. A significant limiting factor is insufficient capital to afford secure offices and equipment. Charlie requires a virtual/physical enclave to do their government work, to include design, coding, data acquisition and analysis, and CUI storage.

4. Applied R&D Delta Defense Innovations is a firm with 18 employees. Delta develops advanced weapons system technologies specializing in the design and manufacture of lightweight, high-durability materials for missile components. Delta receives some revenue from SBIR/STTR contracts, but a significant and growing portion comes from work directly for Defense Primes and next-tier suppliers. The company performs modeling and simulation, CAD/CAM, prototype build, and production line piloting. The company’s primary concern is defending its increasingly profitable intellectual capital from competitors and APTs and thus requires a virtual/physical enclave to do their design, coding, data acquisition and analysis, prototyping (both technology and manufacturing demonstrators) and CUI/ITAR storage.

5. Specialty Manufacturer Echo Manufacturing Inc. has 45 employees, and a strong history in low-quantity specialty production and low-rate initial production (LRIP) of high-quality weapon materials and coatings. Most of the firm's revenue is from subcontracts with major defense prime contractors while fulfilling a few orders directly for DoW entities or for commercial customers. Echo Manufacturing has Defense CUI, such as design specifications, Geometric Dimensioning and Tolerancing (GD&T) and Non-Destructive Testing (NDT) data, as well as process descriptions, much of it proprietary. Additionally, the manufacturing environment includes both IT and OT (operational technology) systems. The firm’s equipment is fairly modern but still requires a virtual/physical enclave encompassing their CAD/CAM systems, treatment facilities, manufacturing lines, and CUI/ITAR storage.

6. Traditional Parts and Components Manufacturer Foxtrot Manufacturing is a long-time (50+ years) DoD full-rate production sub-tier supplier employing 42 people full-time and 20-30 part-time during surge periods. Foxtrot possesses legacy plus newer on-premises IT as well as legacy plus newer production systems. The firm's revenue comes from both direct DoD contracts and as a subcontractor to defense primes. The company handles both received CUI and generated CUI such as military specifications, build-to-print drawings, its internally developed production-process information, GD&T and NDT data. The manufacturing environment includes IT systems, OT systems, and connections to Cloud systems. On-premises equipment is situated in a few offices, but more so in shop and production line facilities requiring a virtual/physical enclave for CUI/ITAR protection.

7. Service Supplier Golf Services, Inc., is a provider of maintenance, repair and supply services for aircraft, ground support vehicles, and flight-line equipment. It has 33 people in its employ. Services provided include ordering, stockpiling, and installation of parts; inventory control; diagnostics; and record keeping. Golf Services performs work for the DoW on and off U.S. military bases and for non-military commercial customers. Golf Services handles both received and generated defense CUI. Golf systems require cybersecurity measures for data storage and network communications, diagnostic testing equipment, and connections to cloud-based storage. A challenge is ensuring cybersecurity of data on hybrid systems from a mixed set of vendors.

7.0 Rating Criteria