Small Business Cybersecure Enclave Pilot Industry Days Q.A Round 1 corrected.pdf

Small Business Cybersecure Enclave Pilot Industry Days Q&A Round 1 - August 21, 2026 - Corrected

1. Question: For the proposed CMMC solutions, are you expecting SaaS, MSP, or MSSP-type solutions, or are you accepting a hybrid software/hardware product?

Answer: This cybersecure enclave pilot is not about CMMC Solutions. Please re-read the short

SOO.

2. Question: What compliance posture is expected at award — DFARS 252.204-7012 and NIST SP 800-

171 alone, or a facility clearance requirement? Given the Department's suspension of CMMC Phase

II, is a Level 2 self-assessment sufficient for this effort?

Answer: This cybersecure enclave pilot is not about CMMC. In this Small Business Cybersecure

Enclave Pilot, all CUI generated/provided in support of the contract will reside on a government owned/managed network. Please re-read the short SOO.

3. Question: Audit representation following the CMMC Phase II suspension. Section 3.0 lists audit representation among required services. Given the Department's 13 July 2026 suspension of CMMC

Phase II and the ongoing reform review, does "audit representation" encompass C3PAO assessments, DCMA DIBCAC assessments, DAF-directed assessments, or all of these? Does the

Government anticipate the reform outcome affecting this requirement?

Answer: This cybersecure enclave pilot is not about CMMC. In this Small Business Cybersecure

Enclave Pilot, all CUI generated/provided in support of the contract will reside on a government owned/managed network. Please re-read the short SOO.

4. Question: Alignment with the CMMC Reform Task Force. On 13 July 2026 the Department of War announced the immediate suspension of CMMC Phase II requirements, originally scheduled for 10

November 2026, and stood up a CMMC Reform Task Force to conduct a 60-day top-to-bottom review reporting to the DoW CIO, with industry input gathered through a public RFI. Phase I self-assessment obligations, NIST SP 800-171 Rev 2, and DFARS 252.204-7012 remain in effect. The stated rationale — that compliance cost and assessment capacity fall hardest on small and non-traditional businesses — is substantially the problem this SOO sets out to solve, and the review period closes at about the same time as this Industry Day. How does the Government intend to align this effort with the Task Force outcome, and is the enclave envisioned as a landing zone for whatever assessment model emerges from it?

Answer: This cybersecure enclave pilot is not about CMMC. In this Small Business Cybersecure

Enclave Pilot, all CUI generated/provided in support of the contract will reside on a government owned/managed network. Please re-read the short SOO.

5. Question: Whether the burden reduction is assessable, not just operational. The stated benefit is

"shifting responsibility for CUI protection to DAF-managed systems." For that to reduce real burden, the small business's own assessment scope has to shrink to the enclave boundary, and whoever performs the assessment has to accept that scoping. Has the DoW CIO or the CMMC program office concurred that a DAF-furnished enclave narrows a contractor's assessment scope, or is establishing that concurrence part of what this effort is meant to accomplish? If a firm still has to assess its full environment, the enclave improves security but does not reduce cost.

Answer: This cybersecure enclave pilot is not about CMMC. In this Small Business Cybersecure

Enclave Pilot, all CUI generated/provided in support of the contract will reside on a government owned/managed network. Please re-read the short SOO.

6. Question: ATO/ATC boundary. Section 5.0 requires the system to obtain an ATO under AFI 17-101 and an ATC from the enclave owner, both of which are framed around operating on a DAF network.

Section 3.0 and the use cases place the enclave in contractor spaces — offices, shop floors, a garage lab, home locations. Is the enclave intended to connect to AFNET, or is it a standalone contractor-side system where DFARS 252.204-7012 and NIST SP 800-171 are the governing standards rather than RMF and SP 800-53? The two readings produce very different architectures, control baselines, and unit costs.

Answer: This cybersecure enclave pilot is not about CMMC. Please re-read the short SOO. Your solution will utilize an ATO. It might be a stand-alone ATO in which case the AO will approve software additions which are demonstrated to be appropriate. Or, you might have a solution you want to connect to the AFNET and utilize the arduous SACA program for software approvals. You tell us what works.

7. Question: Will you accept a SaaS (no hardware) only solution?

Answer: Yes. As a part of a larger, comprehensive small business cybersecure enclave program.

Please re-read the short SOO.

8. Question: The SOO references "affordable secure enclave solutions." Is the government seeking a fully integrated hardware/software appliance, a virtualized/cloud-based enclave, or a hybrid approach? What flexibility does the contractor have in proposing the technical architecture?

Answer: The contractor has complete flexibility to demonstrate a comprehensive Small Business

Cybersecure Enclave program. Please re-read the short SOO.

9. Question: Regarding the NIST SP 800-53/800-171/800-172 alignment requirement — is the government seeking a solution that achieves ATO under the DAF ITAR/RMF process, or will a Plan of

Action & Milestones (POA&M) approach for 800-171 compliance be acceptable for the field test phase?

Answer: There is no alignment with NIST SP 800-171 or NIST SP 800-172 – those standards are for the protection of CUI on a contractor network. In this Small Business Cybersecure Enclave Pilot, all CUI generated/provided in support of the contract will reside on a government owned/managed network. Please re-read the short SOO.

10. Question: The SOO mentions "up to 500 systems annually" for the scale-up plan. Is the 500-unit figure a production target or a planning assumption? Will the government provide the small business participant list, or is the contractor responsible for recruitment and onboarding of participating small businesses?

Answer: Thank you for asking this question. We have changed the SOO to clarify that the field test will be up to 25 Small Business contractors (programs) and for planning each of these contractors would have five IT/OT systems (eventual GFE cybersecurity platforms) endpoints in line with the use cases (laptops, manufacturing equipment, printers, etc.) The task of creating “a manufacturing and service scale-up plan to support government purchase and fielding of up to

500 systems per year” would mean then, 500 IT/OT endpoints.

11. Question: For the field test phase — will the government provide the test environment and participating small business programs, or is the contractor expected to identify and recruit field test participants? How many small business participants are expected for the initial field test?

Answer: Thank you for asking this question. We have changed the SOO to clarify that the field test will be up to 25 Small Business contractors (programs) and for planning each of these contractors would have five IT/OT systems (eventual GFE cybersecurity platforms) endpoints in line with the use cases (laptops, manufacturing equipment, printers, etc.) The task of creating “a manufacturing and service scale-up plan to support government purchase and fielding of up to

500 systems per year” would mean then, 500 IT/OT endpoints.

Question: What are the success criteria for the field test? Will there be specific metrics (e.g., reduction in security findings, time-to-ATO, user satisfaction) that determine a successful demonstration?

Answer: The field test will yield results which will be considered in aggregate. The SOO Section

3.0 describes the outcome of the field test.

12. Question: The SOO references a "Lessons Learned report." Are there specific reporting formats or data collection requirements the contractor should plan for during field testing?

Answer: No.

13. Question: For the Service Provider Plan — does "security patching" and "backup solutions" refer to the enclave infrastructure only, or also to the small business participants' endpoint systems and applications?

Answer: These are for the affordable cybersecure enclave. All CUI generated/provided in support of the contract will reside on a government owned/managed network or system.

14. Question: The SOO mentions "audit representation." Is this referring to DAF/DISA compliance audits

(e.g., RMF assessments, STIG reviews), or external audits such as CMMC assessments by C3PAOs?

Answer: The Small Business Cybersecure Enclave has nothing to do with CMMC. Please re-read the short SOO. The audits would be by the government in the ATO process or other required enterprise audits of enterprise secure systems.

15. Question: Will the government provide a draft evaluation criteria or scoring rubric prior to Industry

Day to help vendors align their solution demonstrations?

Answer: This Industry Day is a market research effort. See Appendix A of the Small Business

Cybersecure Enclave Pilot Instruction document for a list of questions we are excited to see answered by your solution.

16. Question: For the one-on-one solution demonstrations at Industry Day — what format is expected

(live demo, slide presentation, or both)? What is the time allotment per vendor?

Answer: The time allotment can be found in the Small Business Cybersecure Enclave Pilot

Instruction document. Format as you wish.

17. Question: Is the government open to teaming arrangements where a small business prime partners with a hardware/infrastructure manufacturer for the "manufacturing and service scale-up" component, or must the prime contractor demonstrate independent manufacturing capability?

Answer: You tell us what works.

18. Question: Will there be a follow-on solicitation after Industry Day, or is the Special Notice itself the complete solicitation? What is the anticipated award timeline?

Answer: Please review the Small Business Cybersecure Enclave Pilot Instruction document. The

Industry Day is market research only.

19. Question: Is a facility security clearance (FCL) or personnel security clearances required for this effort, or is the work limited to unclassified/CUI environments?

Answer: This pilot is about the protection of CUI by the DAF on a DAF-owned network. Please re-read the short SOO.

20. Question: Regarding Davis-Bacon or Service Contract Act applicability — does the place of performance at Edwards AFB trigger any specific labor category or wage determination requirements?

Answer: The Industry Day is market research only.

21. Question: Are there any small business subcontracting goals or limitations on subcontracting that the government will enforce under this set-aside?

Answer: The Industry Day is market research only.

22. Question: Does the Government envisage the Small Business Cybersecurity Network as a single awardee, a pool of awardees, or a rolling on-ramp? If a pool, is a ceiling on participants anticipated?

Answer: A single awardee.

23. Question: Is the scope oriented toward securing the small-business supply base supporting AFTC, toward AFTC's own mission-system cybersecurity, or both?

Answer: Please see the Target Audience/Users listed under SOO Section 3.0 Scope

24. Question: Where does workforce-facing capability sit within scope — security awareness, phishing and social-engineering resilience, and AI-generated attack simulation — as distinct from network and system defense?

Answer: This is described in SOO Section 3.0 Scope.

25. Question: Does the Government anticipate a requirement for adversary emulation against AI-enabled threats such as synthetic voice and generative phishing, or is the threat scope limited to conventional vectors?

Answer: The Small Business Cybersecure Enclave Pilot will meet the DAF requirements for protection against the threat environment. The contractor should demonstrate a full understanding of the technical requirements to acquire an ATO.

26. Question: Should the one-on-one demonstration be prepared as a fielded capability operating against live data, or as a briefed concept? What classification level will the demonstration space support?

Answer: The demonstration should be unclassified. Please read the Small Business Cybersecure

Enclave Pilot Instruction document. This is a demonstration of an existing solution and demonstration of a full understanding of the technical requirements to attain an ATO. Also, fulfillment of the SOO.

27. Question: Teaming and self-performance. Section 3.0 identifies six deliverable elements spanning architecture, Life-cycle Support, the Service Provider Plan, field testing, Lessons Learned, and scale-

up. Will the Government evaluate elements delivered by a teaming partner or subcontractor at parity with prime self-performance, or does it expect a single entity to self-perform the full scope? If teaming is acceptable, should those arrangements be identified at Industry Day or at RFP?

Answer: All prime contractors have subcontractors. Please speak about your company’s capability to fulfill the SOO through a demonstration of an existing solution and demonstration of a full understanding of the technical requirements to acquire a DAF ATO.

28. Question: Sustainment at fielded scale. Section 3.0 requires a scale-up plan supporting fielding of up to 500 systems per year, and separately requires DAF CISO monthly sessions, audit representation, customer support, and security patching as recurring services. At several hundred fielded tenants, those services scale with headcount rather than with the platform. Does the Government envision a common management and evidence-reporting capability supporting sustainment across the fielded base, and if so, is that capability part of the delivered solution and evaluated under Factor 2?

Answer: Yes.

29. Question: Data rights at transition. Section 3.0 references a government office overseeing a follow-on program of record. What data rights posture does the Government anticipate for solution components at pilot and at transition, particularly for management and compliance-evidence software developed at private expense prior to award? Will the Government accept commercial computer software under DFARS 227.7202 licensing, and does it anticipate requiring Government

Purpose Rights in any component as a condition of the pilot?

Answer: The capability created to fulfill the SOO would be acquired by the government. All CUI generated/provided in support of the contract will reside on a government owned/managed network or system.

30. Question: OT and physical environment scope. Use cases Delta, Echo, Foxtrot, and Golf describe operational technology, shop-floor equipment, CAD/CAM and production systems, diagnostic equipment, and on- and off-base maintenance environments. Does the Government expect a single enclave to extend protection to OT and shop-floor assets, or an IT-scoped enclave with documented boundary exclusions and compensating controls? The answer materially affects architecture and cost.

Answer: You tell us - how your existing solution makes it all happen.

31. Question: Government sponsor for AF E/APL. Section 5.0 requires listing on the AF

Evaluated/Approved Products List via the SACA process, which requires a government sponsor to submit the Application Request Worksheet. Will the Government identify a sponsoring organization for the selected contractor, or is sponsorship the contractor's responsibility to arrange?

Answer: The SACA section has been removed. The AO under your ATO would approve any software which is demonstrated to be appropriate to bring on. Thanks for asking this question.

32. Question: The announcement states the Government intends to conduct Distribution X sessions.

Please confirm the validation method the Government will accept — specifically whether current

Joint Certification Program certification (DD Form 2345) is required for attendance, and the date by which it must be on file. This drives our lead time.

Answer: The Small Business Cybersecure Enclave Pilot Instruction document has been amended to read only unclassified sessions will occur.

33. Question: Please confirm the length and format of the vendor briefing slots, whether visual aids are permitted, and the media and marking requirements for any material we bring into the room.

Answer: Please refer to the latest version of the Small Business Cybersecure Enclave Pilot

Instruction document.

34. Question: So that our briefing is responsive rather than generic, please confirm the anticipated

NAICS and PSC for the follow-on requirement, and whether the Government anticipates a services acquisition, a product or solution acquisition, or both.

Answer: Anticipated NAICS: 541512, Anticipated PSC: DA01

35. Question: Please confirm the preferred page limit and the number of physical copies the

Government would like on hand.

Answer: 5

36. Question: Is there room for a small business on this requirement, either directly or under a prime you already expect to bid?

Answer: The Industry Day is market research on solutions which match the SOO. You tell us how to get there.

37. Question: If not this one, is there a better-fitting requirement in your office I should be tracking?

Answer: Nonsequitur

38. Question: What contract type and ceiling does the Government anticipate for the follow-on effort?

Answer: The Industry Day is market research on solutions which match the SOO.

39. Question: For the AF E/APL listing through the SACA process, will the Government provide a sponsoring office and submit the Application Request Worksheet, or is the vendor expected to secure the sponsor?

Answer: The SACA section has been removed. The AO under your ATO would approve any software which is demonstrated to be appropriate to bring on. Thanks for asking this question.

40. Question: How many small-business programs, and roughly what user counts, do you expect for the base-period field test?

Answer: We expect 15 to 25 small business contractors which represent the use cases.

41. Question: Will the Government furnish the enclave hardware, or should the vendor supply and price hardware as part of the solution?

Answer: You should demonstrate your solution as you see fit.

42. Question: Does the anticipated scope require an ATO and an ATC on a specific DAF network? If so, which network and Authorizing Official?

Answer: It would be an AFTC AO issuing the ATC and/or ATO

43. Question: Is the up-to-500-systems-per-year figure a base-period target, or a planning figure for the option periods and a follow-on program of record?

Answer: Thank you for asking this question. We have changed the SOO to clarify that the field test will be up to 25 Small Business contractors (programs) and for planning each of these contractors would have five IT/OT systems (eventual GFE cybersecurity platforms) endpoints in line with the use cases (laptops, manufacturing equipment, printers, etc.) The task of creating “a manufacturing and service scale-up plan to support government purchase and fielding of up to

500 systems per year” would mean then, 500 IT/OT endpoints.

Question: Operational technology. Use cases 5, 6, and 7 (Echo, Foxtrot, Golf) include manufacturing lines, treatment facilities, diagnostic test equipment, and mixed IT/OT environments. Does the enclave need to protect OT and ICS assets, implicating NIST SP 800-82, or is the boundary limited to

IT systems and CUI data handling with OT explicitly out of scope?

Answer: Yes, the solution should support OT and ICS asset requirements for DAF systems. A successful solution vendor will possess a full understanding of the technical requirements.

44. Question: ITAR. Use cases 4, 5, and 6 reference ITAR storage alongside CUI. Must the solution accommodate ITAR-controlled technical data, and if so, what US-person access control, physical security, and export-authorization requirements apply beyond baseline CUI handling?

Answer: Yes, the solution should support ITAR requirements. A successful solution vendor will possess a full understanding of the technical requirements.

Question: "Existing solution" maturity, teaming, and attendance. The Industry Day announcement states that interested vendors must already possess an existing solution, while the SOO scope covers design, development, and prototyping. What solution maturity — TRL or equivalent — does the

Government expect to see demonstrated in September? Will the Government consider teams in which one firm provides the platform and another provides the compliance advisory, training, andaudit representation described in Section 3.0? And may a firm that does not have a demonstrable solution attend the 17 September Government presentation virtually without occupying a demonstration slot?

Answer: Thank you for this question. We have changed the Instructions to widen the aperture a bit. Please review the Small Business Cybersecure Enclave Pilot Instruction document. Present your solution which fulfills the SOO, as you wish. TRL requirements are addressed in Section 7.

45. Question: Field test participants. How will the "limited number of SB programs" for field testing be identified? May vendors nominate DIB small businesses from their own client base as candidate field test sites, and would participation carry any obligation or cost for the participating firm?

Answer: The SOO states “Field test the solution in a limited number (a range of 15 to 25) of SB programs identified by the government.”

46. Question: Sustainment funding. The announcement notes that funding has not yet been secured.

After field testing, who is expected to fund ongoing MSP/MSSP services, licensing, and hardware refresh — the DAF centrally, the sponsoring program office, or the small business itself? Cost/Price

Realism carries 15% of the evaluation weight, and the answer materially changes any respondent's pricing model.

Answer: The Industry Day is market research. We are asking for demonstrations of existing solutions which would fulfill the SOO. If a future contract led to a successful pilot, then it would be possible for the DAF to acquire the solution, so the enclave would then be a DAF enclave operated by the contractor. Present your solution which fulfills the SOO, as you wish.