Small Business Cybersecure Enclave Pilot Industry Day SOO 08.25.2026.pdf

DRAFT Statement of Objectives (SOO) Small Business Cybersecure Enclave Pilot

Project Description: Pilot and Field Test of Affordable Secure Enclave Solutions for DAF-Furnished CUI Protection in Small Business Contracts

Date: TBD

Preparing Organization: HQ AFTC / AFWERX

1.0 Purpose

The purpose of this Statement of Objectives (SOO) is to obtain contractor support to develop and demonstrate a secure platform which can be procured and thereby become a contractor-operated, government-owned asset/program which t enables the Department of the Air Force (DAF) to furnish small business (SB) contractors with compliant environments for handling Controlled Unclassified Information (CUI). This effort will provide the DAF with a scalable, cost-effective solution that enhances the level of cybersecurity protection and reduces the associated burden on small businesses by shifting responsibility for CUI protection to DAF-managed systems, ensuring mission readiness and operational superiority against advanced persistent threats (APT).

[INDUSTRY DAY NOTE/CLARIFICATION: This pilot is not to provide a means to accomplish Cybersecurity Maturity Model Certification (CMMC) Level 2. This is the DAF protecting its own CUI. All CUI generated/provided in support of the contract will reside on a government owned/managed network or system.

2.0 Background

The DAF relies heavily on SB innovation to advance critical technologies. Currently, SB contractors are required to implement NIST SP 800-171 to fulfill DFARS 252.204-7012. This SOO embraces an alternate paradigm in which the DAF protects the DAF’s CUI with a DAF-provided secure enclave which could be on-premises or cloud-based, but will have an ATO and be comprehensive in its instantiation (training, governance, help-desk, etc.)

• Current Limitations: Implementing NIST SP 800-171 requires dedicated cybersecurity professionals costing $150K+ annually, with CMMC regulations adding additional assessment costs. Over 80% of DAF SB contractors have fewer than 20 employees and cannot protect DAF/DoW CUI in a sustainable model. No certified COTS solutions exist that affordably bridge this gap, exposing critical innovations to vulnerabilities and supply chain risks.

• Mission Need: A transition to DAF-furnished secure enclaves is required immediately to counter advanced persistent threats, particularly stealthy cyber espionage from state-sponsored actors targeting small defense innovators. The need is increasing exponentially due to the emergence of threats employing Artificial Intelligence that can rapidly identify and exploit vulnerabilities.

3.0 Scope

This acquisition encompasses the design, development, prototyping, and field testing of affordable secure enclave solutions applicable to small business environments.

• In Scope:

− Provide a scalable architecture design, hardware, and software (system and application) that meet NIST SP 800-53 (171/172) requirements and can obtain an Authority to Operate (ATO).

− Provide a holistic Life-cycle Support Plan for the enclave solution to be executed by the developing contractor, the government office overseeing the follow-on program of record, and the SB contractor customer base. Include compliance requirements, security training and procedures, and sustainment measures necessary for continuing protection of CUI.

− Provide a Service Provider Plan that includes next business day service, Managed Service Provider (MSP), Managed Security Service Provider (MSSP), hardware, and licensing costs.

Services provided include customer support, security patching, multi-stage backup (onsite warm / offsite cold), multi-zone network security reference architecture, DAF Chief Information Security Officer (CISO) monthly sessions, and audit representation.

− Field test the solution in a limited number (a range of up to 25) of SB programs identified by the government.

− Provide a Lessons Learned report describing the findings from field testing of the solution.

− Provide a manufacturing and service scale-up plan to support government purchase and fielding of up to 500 systems per year

• Target Audience/Users: SB contractors in the Defense Industrial Base (DIB) - to include those under contract via the AFWERX SBIR/STTR program, directly contracted by other DAF/Department of War (DoW) organizations, and subcontractors to defense firms - that involve CUI.

• Possible Other Users: Academic institutions performing under US government grants; foreign contractors providing services to US government agencies operating overseas; non-military government agencies requiring cybersecurity protection of their data beyond that available or affordable by their contractors.

4.0 Period and Place of Performance

• Base Period: 12 months

• Option Periods: 2 x 6 months for additional field tests and/or additional use case assessment

• Primary Location(s): TBD

• Travel Requirements: TBD [INDUSTRY DAY NOTE/CLARIFICATION: Reminder – this Industry Day is market research; there will not be a resultant contract.]

5.0 Performance Objectives (Required Results)

The contractor shall propose a comprehensive solution (in the form of a Performance Work Statement) that meets the requirements for a DAF enclave and the requirements for incorporation into the DAF software registry.

Requirements for a DAF Enclave (ATO & ATC)

To operate on a DAF network, a system must successfully engage in the DAF RMF process to prove that it can adequately protect confidentiality, integrity, and availability in accordance with AFI 17-101 (Risk Management Framework for Air Force IT).

• Risk Management Framework (RMF): The system must implement and validate security controls based on NIST SP 800-53. The baseline controls are determined by the system's categorization (Confidentiality, Integrity, and Availability impact levels).

• Authority to Operate (ATO): An Authorizing Official (AO) must formally accept the risk of operating the system. An ATO is typically valid for three years, or until a major system change occurs, provided the system maintains continuous monitoring.

• Approval to Connect (ATC): Having an ATO does not automatically grant network access. The system must also obtain an ATC from the enclave owner (e.g., the AF Enterprise AO) which is a formal evaluation of the risk of connecting the system to the receiving network.

• Required Artifacts: The program office or system owner must submit a comprehensive body of evidence to justify issuance of the ATO and ATC. The contractor must possess a full understanding of the technical requirements in order to generate this supporting evidence. Such evidence typically includes but is not limited to:

− System Security Plan (SSP) − Security Assessment Report (SAR) − Plan of Action and Milestones (POA&M) for unmitigated vulnerabilities − Hardware and Software lists with associated STIG (Security Technical Implementation

Guide) checklists − Network Topology and Data-Flow Diagrams − Incident Management and Disaster Recovery Plans

6.0 Use Cases

The contractor shall develop comprehensive, acquirable solutions that meet the needs of some or all the use cases below.

1. Software Developer

Alfa Software Development is a firm with five full-time employees and 10 independent subcontractors.

The firm specializes in software solutions for both commercial and government clients. Currently, the firm's contracts and revenue include a mix of efforts direct with DoW, some as a defense subcontractor, and the remainder commercial. Defense contracts include CUI. Alfa requires a virtual/physical enclave to do all their government work which involves coding and CUI storage while using their commercial devices for their non-DoD business. The firm must manage a unique workforce structure, which includes a mix of full-time employees and independent contractors that work across offices, field and home locations.

2. Embedded Software Developer

Bravo Company has 20 full-time employees and five independent subcontractors. The firm specializes in both software and hardware development for government and commercial clients. The company’s product line primarily involves COTS hardware upgraded/modified and programmed with its software.

Currently, the firm's contracts and revenue are a mix of direct with DoW and commercial. One of the firm's limiting factors is the sourcing of their complex supply chains because they both develop and leverage commercially developed software/hardware. Like Alfa, Bravo requires a virtual/physical enclave to do all their government work, to include design, coding, and CUI storage while using their commercial devices for their non-DoD business.

3. Scientific R&D

Charlie LLC is a Small Business Innovation Research (SBIR) firm focused primarily on DoW needs. The firm's six organic employees, two independent subcontractors, and two student interns use research facilities and resources in the owner’s garage and at a university. Charlie’s revenue is 80% DoW and 20% from investor funding. The company performs modeling and simulation, design, instrumented model fabrication, as well as experimentation in laboratory environments. A significant limiting factor is insufficient capital to afford secure offices and equipment. Charlie requires a virtual/physical enclave to do their government work, to include design, coding, data acquisition and analysis, and CUI storage.

4. Applied R&D

Delta Defense Innovations is a firm with 18 employees. Delta develops advanced weapons system technologies specializing in the design and manufacture of lightweight, high-durability materials for missile components. Delta receives some revenue from SBIR/STTR contracts, but a significant and growing portion comes from work directly for Defense Primes and next-tier suppliers. The company performs modeling and simulation, CAD/CAM, prototype build, and production line piloting. The company’s primary concern is defending its increasingly profitable intellectual capital from competitors and APTs and thus requires a virtual/physical enclave to do their design, coding, data acquisition and analysis, prototyping (both technology and manufacturing demonstrators) and CUI/ITAR storage.

5. Specialty Manufacturer

Echo Manufacturing Inc. has 45 employees, and a strong history in low-quantity specialty production and low-rate initial production (LRIP) of high-quality weapon materials and coatings. Most of the firm's revenue is from subcontracts with major defense prime contractors while fulfilling a few orders directly for DoW entities or for commercial customers. Echo Manufacturing has Defense CUI, such as design specifications, Geometric Dimensioning and Tolerancing (GD&T) and Non-Destructive Testing (NDT) data, as well as process descriptions, much of it proprietary. Additionally, the manufacturing environment includes both IT and OT (operational technology) systems. The firm’s equipment is fairly modern but still requires a virtual/physical enclave encompassing their CAD/CAM systems, treatment facilities, manufacturing lines, and CUI/ITAR storage.

6. Traditional Parts and Components Manufacturer

Foxtrot Manufacturing is a long-time (50+ years) DoD full-rate production sub-tier supplier employing 42 people full-time and 20-30 part-time during surge periods. Foxtrot possesses legacy plus newer on-premises IT as well as legacy plus newer production systems. The firm's revenue comes from both direct DoD contracts and as a subcontractor to defense primes. The company handles both received CUI and generated CUI such as military specifications, build-to-print drawings, its internally developed production-process information, GD&T and NDT data. The manufacturing environment includes IT systems, OT systems, and connections to Cloud systems. On-premises equipment is situated in a few offices, but more so in shop and production line facilities requiring a virtual/physical enclave for CUI/ITAR protection.

7. Service Supplier

Golf Services, Inc., is a provider of maintenance, repair and supply services for aircraft, ground support vehicles, and flight-line equipment. It has 33 people in its employ. Services provided include ordering, stockpiling, and installation of parts; inventory control; diagnostics; and record keeping. Golf Services performs work for the DoW on and off U.S. military bases and for non-military commercial customers.

Golf Services handles both received and generated defense CUI. Golf Services requires cybersecurity measures for data storage and network communications, diagnostic testing equipment, and connections to cloud-based storage. A challenge is ensuring cybersecurity of data on hybrid systems from a mixed set of vendors.

7.0 Rating Criteria

Evaluation Factor Weight Description

1. Technical Approach & Security Compliance

40% Evaluates the robustness of the architecture (Zero Trust, multi-zone networking, etc.) and the feasibility of achieving an ATO under NIST SP 800-53. Assesses how well the solution protects CUI against advanced threats.

2. Usability, Operations & Sustainment

25% Evaluates how well the solution reduces the burden on small businesses. Includes the quality of the MSP/MSSP services, CISO support, training, backup solutions, and the overall user experience for non-technical SB personnel.

3. Business, Scaling & Transition Plan

20% Evaluates the contractor's plan to manufacture, support, finance, and scale the solution across the SB DIB (including subcontractors), as well as their strategy to achieve Technical Readiness Level (TRL) 8 during field testing.

4. Cost / Price Realism 15% Evaluates the overall affordability of the solution, including hardware, licensing, and ongoing sustainment costs, ensuring it provides a cost-effective alternative to traditional compliance methods.