Small Business Cybersecure Enclave Pilot Industry Days Q.A Round 2 09.13.2026.pdf

Small Business Cybersecure Enclave Pilot Industry Days Q&A Round 2 – September 12, 2026

1. Question: We are very interested in the Small Business Cybersecurity Network Industry Days and wanted to confirm one point regarding the maturity expected of participating solutions. [Redacted] has an existing, cost-effective solution, designed specifically to provide small defense contractors with a bounded environment for FCI and CUI. The enclave is deployed on-premises and/or in data centers rather than hosted in the public cloud, while allowing controlled, policy-authorized access to approved cloud destinations when required. Our current security posture is designed around CMMC

Level 2, with the architecture and technical controls designed to support the additional requirements associated with CMMC Level 3. The enclave can also be configured for Level 1/FCI-only environments. The platform incorporates a purpose-built Zero Trust architecture, certificate-based authentication and authorization, strong network and workload isolation, centralized security monitoring and evidence generation, controlled CUI transfer, tightly restricted communications paths, hybrid post-quantum encryption, and FIPS 140-3 validated cryptographic modules. We are not currently operating the enclave under a NIST SP 800-53-based Air Force ATO. We have developed a technical roadmap for mapping, implementing, documenting, and validating the applicable 800-53 controls, but we want to be transparent that our team has not previously taken a commercial product through the Air Force ATO process. We noted that the announcement requires participating vendors to already possess an existing solution, while the SOO describes an architecture that meets the applicable NIST SP 800-53 requirements and can obtain an ATO.

Could you confirm whether an existing operational solution such as the enclave, with a defined technical path to the required NIST SP 800-53/ATO posture, is appropriate for Industry Day participation, or whether the Government expects participating solutions to have already completed that authorization process?

Answer: The Small Business Cybersecure Enclave Pilot will meet the DAF requirements for protection against the threat environment. The contractor should demonstrate a full understanding of the technical requirements to acquire an ATO. There is no alignment with NIST

SP 800-171 or NIST SP 800-172 – those standards are for the protection of CUI on a contractor network. In this Small Business Cybersecure Enclave Pilot, all CUI generated/provided in support of the contract will reside on a government owned/managed network. Please re-read the short

SOO.

2. Question: I am considering registering for a virtual presentation if there are open slots; this is new territory for me. My question is about showing a brief VIDEO of Zero-Backend Ephemeral Routing with Connectivity-Agnostic BLE Mesh. The copyrighted prototype infrastructure was originally released by Apple in 2014 and by Google in 2015, along with a short PowerPoint and a functionality graphic. Would that be sufficient? Below are earlier demo videos of the prototype.

Answer: The demonstration should be unclassified. Please read the Small Business Cybersecure

Enclave Pilot Instruction document. This is a demonstration of an existing solution and demonstration of a full understanding of the technical requirements to attain an ATO. Also, fulfillment of the SOO.

3. Question: With respect to the Statement of Objectives (SOO) defined, we have a question pertaining to the desired outcome. The SOO makes reference to either an on premise or virtual. The seven (7) use cases illustrate traditional DIB GovCon environments that are already capable of being met via MSFT GCC or GCC-HIGH (ITAR Dependent). Would the Air Force be open to exploring an option that would drastically limit its CapEX exposure and use already proven solutions that are CMMC Level 2 Certified with the use of a CMMC L2 Certified External Services Provider?

Example One: In Scenario #5, we can address 45 employees that have a legitimate/business need to access CUI for approximately $100,000 annually, provides continuous monitoring of all technical, operational, and managerial controls, with zero setup fees. This approach has yielded formal certificates of status at CMMC Level 2 for between $16K-$25K as issued from other C3PAOs.

Example Two: In Scenario #3, we can address 6 employees, 2 interns, and 2 1099s, that have a legitimate/business need to access CUI for approximately $53,000 annually, provides continuous monitoring of all technical, operational, and managerial controls, with zero setup fees. This approach has yielded formal certificates of status at CMMC Level 2 for between $16K-$25K as issued from other C3PAOs.

When evaluating the costs associated with the levels of effort needed to bring a third party-hosted solution through ATO and ATC, the value to the Government is maximizing a path that can be stood up quickly, repeatable, scalable, has leadership familiar with being able to provide your J6 with monthly SARs for each client, and has close ties to the Cyber Engagement Forum.

4. If this option is appealing, we would like to make a pitch on the 17th or 18th. If the Air Force is dead set on the approach as outlined, we respect your decision and we would not proceed further.

Answer: There is no alignment with NIST SP 800-171 or NIST SP 800-172 – those standards are for the protection of CUI on a contractor network. In this Small Business Cybersecure Enclave Pilot, all CUI generated/provided in support of the contract will reside on a government owned/managed network. Please re-read the short SOO.

5. Question: We are seeking clarification on NIST alignment requirements outlined in the SOO, as there appear to be references across Sections 3.0, 5.0, and 7.0 to both NIST SP 800-171 and NIST SP 800-

53 in relation to CUI protection, RMF implementation, and ATO expectations. Could you please confirm whether the enclave should be aligned to NIST SP 800-171 or NIST SP 800-53 for the intended system scope and evaluation criteria? If 800-171 applies, we would appreciate confirmation on whether Rev 2 or Rev 3 should be used; if 800-53 applies, please confirm whether

Rev 5 is the correct baseline given the withdrawal of Rev 4 in 2021.

Answer: There is no alignment with NIST SP 800-171 or NIST SP 800-172 – those standards are for the protection of CUI on a contractor network. In this Small Business Cybersecure Enclave Pilot, all CUI generated/provided in support of the contract will reside on a government owned/managed network. Please re-read the short SOO.

6. Question: May two or more small-business vendors participate as an integrated team during the

Industry Day, with one company demonstrating the core cybersecure-enclave platform and another demonstrating complementary data integration, onboarding, operational reporting, and deployment capabilities? If so, should each company register separately, or should one company register on behalf of the team?

Answer: Please register as a team.

7. Question: Does the Government envision a physical appliance or endpoint-based enclave, a cloud-hosted enclave, a virtual desktop environment, a hybrid solution, or multiple acceptable architectures? May contractor-owned endpoints connect through a secure browser, managed client, virtual desktop, or zero-client arrangement, and may vendors propose a securely segmented multi-tenant platform or must each business receive a dedicated enclave?

Answer: You tell us what works.

8. Question: Which specific revisions, baselines, and requirements will govern the solution, including

NIST SP 800-53, NIST SP 800-171, NIST SP 800-172, CMMC, applicable DFARS clauses, FIPS-validated cryptography, and other DAF cybersecurity requirements? What CMMC level is anticipated and will every NIST SP 800-172 enhanced requirement apply or only requirements selected through the threat and risk assessment?

Answer: This cybersecure enclave pilot is not about CMMC Solutions. Please re-read the short

SOO.

9. Question: Is the contractor expected to obtain a single DAF ATO for the enclave platform, separate

ATOs for each customer deployment, or an authorization that can be inherited or reused across participating small businesses? Which Government organization will serve as the Authorizing Official or sponsor the RMF process? For the demonstration, may vendors show an operational platform with a documented path to authorization, or must it already possess a federal authorization, FedRAMP authorization, or CMMC certification?

Answer: The Small Business Cybersecure Enclave Pilot will meet the DAF requirements for protection against the threat environment. The contractor should demonstrate a full understanding of the technical requirements to acquire an ATO. This cybersecure enclave pilot is not about CMMC. In this Small Business Cybersecure Enclave Pilot, all CUI generated/provided in support of the contract will reside on a government owned/managed network. Please re-read the short SOO.

10. Question: What are the anticipated characteristics of the field-test participants, including users, locations, current IT environments, remote-work needs, and applications or workflows that must operate within the enclave? Should vendors plan for CAD/CAM, engineering and manufacturing systems, CNC or operational technology, product-lifecycle platforms, source-code repositories, CI/CD pipelines, containers, software bills of materials, or application-security testing?

Answer: Yes, the solution should support OT and ICS asset requirements for DAF systems. A successful solution vendor will possess a full understanding of the technical requirements. Please re-read the short SOO, taking note of the use cases.

11. Question: What CUI categories, dissemination controls, and use cases should the enclave support?

Please identify anticipated data types, file formats, volumes, retention requirements, collaboration patterns, and whether workloads may include engineering drawings, CAD files, source code, export-controlled ITAR or EAR technical data, email, document collaboration, or specialized applications. Is any classified processing contemplated, or will the enclave be limited to unclassified information?

Answer: The solution should support OT and ICS asset requirements for DAF systems. A successful solution vendor will possess a full understanding of the technical requirements. Please re-read the short SOO, taking note of the use cases.

12. Question: Will the contractor be responsible for discovering, identifying, classifying, cleansing, and migrating existing CUI from each participating business? Must the platform identify and classify CUI automatically as it enters, leaves, or moves among authorized environments? If so, will the

Government provide anticipated source-system, repository, file, record, and volume estimates?

What requirements apply to ingestion, export, retention, legal hold, backup, sanitization, final destruction, and maintenance of a CUI inventory and data-flow map? At service end, must the vendor provide a complete export of CUI, logs, configurations, compliance evidence, and audit records?

Answer: The solution should support OT and ICS asset requirements for DAF systems. A successful solution vendor will possess a full understanding of the technical requirements. Please re-read the short SOO, taking note of the use cases.

13. Question: What Government platforms, customer applications, identity services, collaboration tools, networks, and data sources must the enclave integrate with? Should vendors anticipate DoD

Microsoft 365, NIPRNet, CAC/PKI or DAF ICAM, PIEE, DIBNet, ERP and engineering systems, third-party SaaS, or DAF SOC/SIEM integration? What interfaces, event formats, ports, protocols, services, and Approval-to-Connect requirements will apply?

Answer: The solution should support OT and ICS asset requirements for DAF systems. A successful solution vendor will possess a full understanding of the technical requirements. Please re-read the short SOO, taking note of the use cases.

14. Question: How many small businesses, users, systems, locations, and use cases does the

Government anticipate including in the initial field test? What duration, deployment schedule, geographic coverage, and on-site support should vendors assume? Will the DAF provide representative or sanitized data, applications, interfaces, facilities, end users, equipment, connectivity, licenses, or shared cybersecurity services?

Answer: Thank you for asking this question. We have changed the SOO to clarify that the field test will be up to 25 Small Business contractors (programs) and for planning each of these contractors would have five IT/OT systems (eventual GFE cybersecurity platforms) endpoints in line with the use cases (laptops, manufacturing equipment, printers, etc.) The task of creating “a manufacturing and service scale-up plan to support government purchase and fielding of up to

500 systems per year” would mean then, 500 IT/OT endpoints.

15. Question: What technical, cybersecurity, operational, affordability, usability, customer-adoption, and quantitative TRL 8 criteria will the Government use to determine whether field testing is successful? Will the Government provide a required test plan, metrics, minimum performance thresholds, or acceptance methodology?

Answer: The field test will yield results which will be considered in aggregate. The SOO Section

3.0 describes the outcome of the field test. You would propose a field test plan.

16. Question: Does the objective of supporting up to 500 systems annually refer to 500 individual endpoints, 500 separate small-business enclave deployments, 500 sites, or another unit of measure?

What number of users should be assumed per system?

Answer: Thank you for asking this question. We have changed the SOO to clarify that the field test will be up to 25 Small Business contractors (programs) and for planning each of these contractors would have five IT/OT systems (eventual GFE cybersecurity platforms) endpoints in line with the use cases (laptops, manufacturing equipment, printers, etc.) The task of creating “a manufacturing and service scale-up plan to support government purchase and fielding of up to

500 systems per year” would mean then, 500 IT/OT endpoints.

17. Question: Has the Government established a target acquisition cost, annual operating cost, or affordability threshold for a small business, including one with fewer than 20 employees? Should pricing be structured by user, endpoint, enclave, company, subscription period, managed service, or consumption? Should vendors separately identify prototype and field-test costs, production deployment, recurring licensing, sustainment, transition, and managed-service costs?

Answer: This Industry Day is a market research effort. See Appendix A of the Small Business

Cybersecure Enclave Pilot Instruction document for a list of questions we are excited to see answered by your solution.

18. Question: Is the desired outcome to remove participating-contractor endpoints and networks from the CMMC assessment boundary, or primarily to reduce the number of systems and controls within that boundary? To what extent may enclave controls and service-provider evidence be used during each contractor's CMMC assessment?

Answer: This cybersecure enclave pilot is not about CMMC. In this Small Business Cybersecure

Enclave Pilot, all CUI generated/provided in support of the contract will reside on a government owned/managed network. Please re-read the short SOO.

19. Question: Does the DAF expect the service provider to furnish a complete solution, including endpoints, servers, network equipment, security software, licensing, configuration, connectivity, backup, maintenance, and ongoing support? Which components, if any, will be Government-furnished or remain the participating business's responsibility?

Answer: This is described in SOO Section 3.0 Scope.

20. Question: What granular monitoring, audit logging, real-time alerting, session recording, and data-loss-prevention controls are required? Must the solution inspect the content of encrypted traffic, or only collect connection records, metadata, authentication events, and security telemetry? Please address privileged and standard users; email, browser, file-transfer, printing, screenshot, clipboard, upload, download, local-device, removable-media, and external-storage activity; required retention and storage locations; tamper-evident storage; and who may review the resulting records.

Answer: This is described in SOO Section 3.0 Scope. Please read the Small Business Cybersecure

Enclave Pilot Instruction document. This is a demonstration of an existing solution and demonstration of a full understanding of the technical requirements to attain an ATO. Also, fulfillment of the SOO.

21. Question: Will the enclave store and process CUI directly, or may CUI remain in authorized SaaS environments while the enclave provides access control, monitoring, and proxy services? Which

SaaS platforms and authorization levels are acceptable, how are security responsibilities allocated, must the enclave collect SaaS activity through APIs, and what must occur if a connected platform becomes unavailable, loses authorization, or experiences an incident?

Answer: You tell us - how your existing solution makes it all happen.

22. Question: Will service-provider personnel require access to customer CUI for administration, maintenance, troubleshooting, backup, or incident response? If so, what citizenship, background-investigation, training, location, facility, system, and approval requirements apply, and must the DAF approve changes to administrators, subcontractors, cloud providers, or supporting security services?

Answer: This is described in SOO Section 3.0 Scope. Please read the Small Business Cybersecure

Enclave Pilot Instruction document. This is a demonstration of an existing solution and demonstration of a full understanding of the technical requirements to attain an ATO. Also, fulfillment of the SOO.

23. Question: Who will own and control encryption keys for CUI, logs, and backups? What encryption standards, rotation and revocation capabilities, and Government- or customer-managed key options are required? Must each participating business have separate keys, policies, audit records, and administrative boundaries?

Answer: This is described in SOO Section 3.0 Scope. Please read the Small Business Cybersecure

Enclave Pilot Instruction document. This is a demonstration of an existing solution and demonstration of a full understanding of the technical requirements to attain an ATO. Also, fulfillment of the SOO.

24. Question: What evidence must the platform generate for continuous compliance, CMMC assessments, ATO maintenance, and Government oversight? Will the DAF provide a responsibility or control-allocation matrix identifying controls inherited from the DAF, supplied by the enclave provider, or retained by each participating small business?

Answer: This is described in SOO Section 3.0 Scope. Please read the Small Business Cybersecure

Enclave Pilot Instruction document. This is a demonstration of an existing solution and demonstration of a full understanding of the technical requirements to attain an ATO. Also, fulfillment of the SOO. This cybersecure enclave pilot is not about CMMC. In this Small Business

Cybersecure Enclave Pilot, all CUI generated/provided in support of the contract will reside on a government owned/managed network.

25. Question: What recovery-time and recovery-point objectives, retention periods, geographic-separation rules, encryption requirements, and backup locations apply, including the meaning of

'onsite warm' backup? Must the enclave continue enforcing access controls during identity-provider, monitoring-service, or Government-network outages, and must it support intermittent or disconnected operation?

Answer: This is described in SOO Section 3.0 Scope. Please read the Small Business Cybersecure

Enclave Pilot Instruction document. This is a demonstration of an existing solution and demonstration of a full understanding of the technical requirements to attain an ATO. Also, fulfillment of the SOO.

26. Question: Should the MSP or MSSP service include continuous security monitoring and 24-hour incident response, or is next-business-day support acceptable? What events require immediate DAF notification, what reporting timeframes apply, and will the DAF provide detection rules, alert thresholds, escalation procedures, and incident-response playbooks?

Answer: This is described in SOO Section 3.0 Scope. Please read the Small Business Cybersecure

Enclave Pilot Instruction document. This is a demonstration of an existing solution and demonstration of a full understanding of the technical requirements to attain an ATO. Also, fulfillment of the SOO.

27. Question: Does the SACA and E or APL requirement apply to the enclave as an integrated solution, or to every commercial, vendor-developed, and open-source component? Will the DAF provide submission procedures, criteria, documentation, and review timelines? May supported open-source components be used, and what Section 889, domestic-source, prohibited-country, and supply-chain risk requirements apply?

Answer: This is described in SOO Section 3.0 Scope. Please read the Small Business Cybersecure

Enclave Pilot Instruction document. This is a demonstration of an existing solution and demonstration of a full understanding of the technical requirements to attain an ATO. Also, fulfillment of the SOO. Answer: The SACA section has been removed. The AO under your ATO would approve any software which is demonstrated to be appropriate to bring on. Thanks for asking this question.

28. Question: What demonstration scenarios, format, duration, representative limit, and data conditions does the DAF prefer? Should vendors submit a proposed PWS with the statement of interest, and if so, what structure, page limit, work breakdown, and deliverables are expected? Will proprietary information be protected, will answers be distributed to all interested vendors, will the

SOO be amended if responses materially change or clarify the requirements, and may multiple solutions be selected for parallel prototyping?

Answer: The Industry Day is market research on solutions which match the SOO. The demonstration should be unclassified. Please read the Small Business Cybersecure Enclave Pilot

Instruction document. This is a demonstration of an existing solution and demonstration of a full understanding of the technical requirements to attain an ATO. Also, fulfillment of the SOO.

29. Question: What is expected during the monthly sessions with the DAF CISO? Will these be program-level meetings or separate sessions for each participating small business, who must attend, and what status, risk, compliance, incident, service-level, and performance reporting must the contractor provide?

Answer: Thanks for this question. This is a typo, the monthly sessions would be with the DAF AO to talk about the operation/progress of the ATO.

30. Question: Does the Government consider commercial-off-the-shelf (COTS) secure enclave solutions provided via Microsoft or Google cloud platforms (or their authorized partners/resellers) acceptable, provided they meet NIST SP 800-171/172 requirements and are capable of obtaining an ATO in a

DAF-compliant environment?

Answer: There is no alignment with NIST SP 800-171 or NIST SP 800-172 – those standards are for the protection of CUI on a contractor network. In this Small Business Cybersecure Enclave Pilot, all CUI generated/provided in support of the contract will reside on a government owned/managed network. Please re-read the short SOO.

31. Question: Are there any restrictions or preferences regarding the underlying cloud infrastructure?

Specifically: Must the enclave run in a FedRAMP High / DoD IL4+ authorized environment (e.g., Microsoft GCC High / Azure Government, Google Assured Workloads / equivalent)?

Answer: You tell us what works.

32. Question: Is a commercial cloud with a properly isolated/enclaved configuration (with US data residency, screened personnel, etc.) acceptable if it still enables full NIST 800-171 compliance and

ATO?

Answer: There is no alignment with NIST SP 800-171 or NIST SP 800-172 – those standards are for the protection of CUI on a contractor network. In this Small Business Cybersecure Enclave Pilot, all CUI generated/provided in support of the contract will reside on a government owned/managed network. Please re-read the short SOO.

33. Question: Are hybrid (on-prem + cloud) or pure cloud-based COTS solutions preferred or equally acceptable?

Answer: You tell us what works.

34. Question: For partner-provided solutions (e.g., a small business prime leveraging a Microsoft or

Google partner’s COTS enclave offering): Is it acceptable for the small business offeror to resell/manage/operate a partner’s COTS enclave as the core of the solution, as long as the prime retains overall responsibility for integration, MSP services, field testing, and the manufacturing/scale-up plan?

Answer: The capability created to fulfill the SOO would be acquired by the government. All CUI generated/provided in support of the contract will reside on a government owned/managed network or system.

35. Question: Must the small business itself own/develop the core enclave technology, or is a teaming/reseller arrangement with an established Microsoft/Google partner permitted under the total small business set-aside?

Answer: The capability created to fulfill the SOO would be acquired by the government. All CUI generated/provided in support of the contract will reside on a government owned/managed network or system. The government intends to have Unlimited Rights to all technology, data, and deliverables resulting from this effort IAW DFARS 252.227-7013, 7014, 7015, etc. This scheduled

Industry Day is for Market Research purposes only and shall be used IAW RFO Part 10 to identify potential vendors and gather information to determine an acquisition strategy. This announcement and subsequent Industry Day is not a solicitation for a proposal.

36. Question: What evidence or documentation will be required during Industry Day demos or any follow-on RFI/RFP to demonstrate that a COTS Microsoft- or Google-based enclave can achieve ATO and sustainably support small businesses at the target cost point (well below the ~$150k+ annual barrier cited)?

Answer: The number you sight is part of the background information. Please review the Small

Business Cybersecure Enclave Pilot Instruction document. The Industry Day is market research only.

37. Question: Can you confirm or expand on the expected form of the “secure enclave”? Is the

Government primarily seeking:

Turnkey hardware appliances + software? Cloud-based (VDI, dedicated tenants, or segmented environments)? Fully managed service offerings? Or a flexible combination?

Answer: The Small Business Cybersecure Enclave Pilot will meet the DAF requirements for protection against the threat environment. The contractor should demonstrate a full understanding of the technical requirements to acquire an ATO. You tell us what works.

38. Question: What are the key evaluation criteria or “must-have” capabilities for Industry Day demonstrations? (e.g., cost model for the end small-business user, ease of deployment/onboarding, support for CMMC Level 2 assessment readiness, scalability to 500 units/year, specific integration with DAF systems, etc.)

Answer: This cybersecure enclave pilot is not about CMMC. In this Small Business Cybersecure

Enclave Pilot, all CUI generated/provided in support of the contract will reside on a government owned/managed network. Please re-read the short SOO.

39. Question: Regarding the MSP plan and lifecycle support: Are there preferred or required elements beyond next-business-day support, patching, backups, monthly CISO sessions, and audit representation? How important is a long-term sustainment model that keeps total cost of ownership low for very small firms?

Answer: You tell us what works.

40. Question: Will solutions that already have existing ATOs, FedRAMP authorizations, or proven deployments in the Defense Industrial Base receive any preference or expedited consideration?

Answer: Please review the Small Business Cybersecure Enclave Pilot Instruction document. The

Industry Day is market research only.

41. Question: Is there any guidance on intellectual property, data rights, or the manufacturing/scale-up plan? (Especially relevant if leveraging a partner’s COTS platform.)

Answer: The Small Business Cybersecure Enclave Pilot will meet the DAF requirements for protection against the threat environment. The contractor should demonstrate a full understanding of the technical requirements to acquire an ATO.

42. Question: Any additional technical or compliance constraints in the SOO (e.g., specific encryption, logging, zero-trust requirements, air-gapped options, or prohibited commercial services) that would impact Microsoft- or Google-based COTS enclaves?

Answer: The Small Business Cybersecure Enclave Pilot will meet the DAF requirements for protection against the threat environment. The contractor should demonstrate a full understanding of the technical requirements to acquire an ATO.

43. Question: How do you anticipate competing FA930426C0000, a small business set-aside, full and open with subcontracting goals, or another path? I want a qualified small business positioned correctly rather than guessing.

Answer: Please review the Small Business Cybersecure Enclave Pilot Instruction document. The

Industry Day is market research only.

44. Question: Is there a sources-sought or RFI stage where I should submit a capability response, and roughly when do you expect the solicitation to post?

Answer: Please review the Small Business Cybersecure Enclave Pilot Instruction document. The

Industry Day is market research only.

45. Question: Is there a preferred contract vehicle, whether GSA MAS, an existing IDIQ, or open market?

Answer: Please review the Small Business Cybersecure Enclave Pilot Instruction document. The

Industry Day is market research only.

46. Question: Is there room for a small business on this requirement, either directly or under a prime you already expect to bid?

Answer: Please review the Small Business Cybersecure Enclave Pilot Instruction document. The

Industry Day is market research only.

47. Question: If not this one, is there a better-fitting requirement in your office I should be tracking?

Answer: Nonsequitur

48. Question: What level of maturity must a solution have to qualify as an “existing solution”? Would an operational minimum viable product supported by prior customer implementations qualify, or must the complete product already be commercially deployed?

Answer: The contractor should demonstrate a full understanding of the technical requirements to acquire an ATO.

49. Question: Is the Government seeking a cybersecurity software platform, managed cybersecurity services, implementation and integration services, or a combination of these capabilities?

Answer: Please speak about your company’s capability to fulfill the SOO through a demonstration of an existing solution and demonstration of a full understanding of the technical requirements to acquire a DAF ATO.

50. Question: Is the intended solution primarily for the Air Force’s internal networks, for small businesses supporting the Air Force, or for both?

Answer: All prime contractors have subcontractors. Please speak about your company’s capability to fulfill the SOO through a demonstration of an existing solution and demonstration of a full understanding of the technical requirements to acquire a DAF ATO.

51. Question: Can the Government provide additional information about the anticipated hosting environment, including whether the solution must operate in AWS GovCloud, Azure Government, an on-premises environment, or across multiple environments?

Answer: Please speak about your company’s capability to fulfill the SOO through a demonstration of an existing solution and demonstration of a full understanding of the technical requirements to acquire a DAF ATO. You tell us what works.

52. Question: Does the Government anticipate deployment into an existing environment, establishment of a new environment, or support for both deployment scenarios?

Answer: Please speak about your company’s capability to fulfill the SOO through a demonstration of an existing solution and demonstration of a full understanding of the technical requirements to acquire a DAF ATO. You tell us what works.

53. Question: Which cybersecurity and compliance frameworks must the solution support, such as NIST

SP 800-171, CMMC, NIST SP 800-53, FISMA, FedRAMP, or applicable DoD Impact Levels?

Answer: Please speak about your company’s capability to fulfill the SOO through a demonstration of an existing solution and demonstration of a full understanding of the technical requirements to acquire a DAF ATO. There is no alignment with NIST SP 800-171 or NIST SP 800-

172 – those standards are for the protection of CUI on a contractor network. In this Small

Business Cybersecure Enclave Pilot, all CUI generated/provided in support of the contract will reside on a government owned/managed network. Please re-read the short SOO. You tell us what works.

54. Question: Will the solution process only unclassified information, or should vendors anticipate handling CUI or information subject to more restrictive distribution controls?

Answer: This is described in SOO Section 3.0 Scope.

55. Question: Are any existing Government authorizations, facility clearances, personnel clearances, citizenship requirements, or specific personnel certifications required to participate or perform the anticipated work? Will offshore personnel be permitted?

Answer: Please speak about your company’s capability to fulfill the SOO through a demonstration of an existing solution and demonstration of a full understanding of the technical requirements to acquire a DAF ATO.

56. Question: What capabilities or use cases does the Government expect vendors to demonstrate during the one-on-one sessions, and how much time will each vendor receive?

Answer: Please read the Small Business Cybersecure Enclave Pilot Instruction document. This is a demonstration of an existing solution and demonstration of a full understanding of the technical requirements to attain an ATO. Also, fulfillment of the SOO. Please note Section 6 of the SOO, Use

Cases.

57. Question: Will virtual and in-person participants receive equivalent one-on-one demonstration opportunities and access to Government representatives?

Answer: The event is virtual. Please read the Small Business Cybersecure Enclave Pilot Instruction document

58. Question: Section 3.0 calls for "a scalable architecture design, hardware, and software (system and application) that meet NIST SP 800-53 (171/172) requirements and can obtain an Authority to

Operate (ATO)." Does DAF expect NIST SP 800-171 and 800-172 requirements to be layered on top of the 800-53 baseline, or handled some other way?

Answer: Thanks for drawing this typo to our attention. There is no alignment with NIST SP 800-171 or NIST SP 800-172 – those standards are for the protection of CUI on a contractor network. In this Small Business Cybersecure Enclave Pilot, all CUI generated/provided in support of the contract will reside on a government owned/managed network.

59. Question: Section 3.0 calls for a "manufacturing and service scale-up plan to support government purchase and fielding of up to 500 systems per year." Does DAF anticipate each small business entity having its own system or enclave?

Answer: You tell us what works.

60. Question: Section 3.0 says the contractor shall address "some or all" of the seven use cases. Would

DAF accept and evaluate a proposal scoped to a single use case, for example just the software developer or the specialty manufacturer scenario, or does the evaluation expect a solution that addresses multiple use cases at minimum?

Answer: Yes, the solution should support ITAR requirements. A successful solution vendor will possess a full understanding of the technical requirements of all use cases.

61. Question: Section 5.0, under Risk Management Framework, states: "The system must implement and validate security controls based on NIST SP 800-53. The baseline controls are determined by the system's categorization (Confidentiality, Integrity, and Availability impact levels)." The process for determining the security categorization of federal information systems is outlined in FIPS 199. What security categorization does DAF anticipate the proposed information system(s) will hold?

Answer: The solution should support OT and ICS asset requirements for DAF systems. A successful solution vendor will possess a full understanding of the technical requirements. Please re-read the short SOO, taking note of the use cases.

62. Question: Section 5.0, under Approval to Connect, states: "Having an ATO does not automatically grant network access. The system must also obtain an ATC from the enclave owner (e.g., the AF

Enterprise AO) which is a formal evaluation of the risk of connecting the system to the receiving network." Does the enclave physically or logically connect to a DAF network, requiring an ATC, or is it a standalone furnished environment? If standalone, is a full DAF ATO actually required, or is NIST

SP 800-171 / CMMC sufficient for the small business use cases?

Answer: There is no alignment with NIST SP 800-171 or NIST SP 800-172 – those standards are for the protection of CUI on a contractor network. In this Small Business Cybersecure Enclave Pilot, all CUI generated/provided in support of the contract will reside on a government owned/managed network. Please re-read the short SOO.

63. Question: Acquisition path: Should industry anticipate a FAR-based competition, SBIR/STTR authorities via AFWERX, or another approach (CSO/OTA) for any future procurement action?

Answer: Please review the Small Business Cybersecure Enclave Pilot Instruction document. The

Industry Day is market research only.

64. Question: Award structure: Does the Government envision a single solution provider for the pilot and field test, or multiple providers, similar to the Army's N-CODE model?

Answer: A single awardee.

65. Question: RMF boundary: For the ATO described in SOO Section 5.0, who is the anticipated

Authorizing Official, and is the intended boundary a DAF-hosted enclave, a contractor-hosted environment with DAF oversight, or open to the proposed architecture?

Answer: Please speak about your company’s capability to fulfill the SOO through a demonstration of an existing solution and demonstration of a full understanding of the technical requirements to acquire a DAF ATO.

66. Question: E/APL timing: Is AF E/APL listing through the SACA process a prerequisite before field testing begins, or an objective to achieve during the base period?

Answer: The SACA section has been removed. The AO under your ATO would approve any software which is demonstrated to be appropriate to bring on. Thanks for asking this question.

67. Question: Use case coverage: Section 6.0 states solutions may meet some or all of the use cases.

Will evaluation favor breadth across all seven, or is depth on a subset (for example, manufacturing and OT-heavy environments) equally competitive?

Answer: Please read the Small Business Cybersecure Enclave Pilot Instruction document. This is a demonstration of an existing solution and demonstration of a full understanding of the technical requirements to attain an ATO. Also, fulfillment of the SOO. Please note Section 6 of the SOO, Use

Cases.

68. Question: CUI scope: Should solutions target CUI Basic only, or also CUI Specified categories (for example, export-controlled data) with NIST SP 800-172 enhanced protections?

Answer: Please read the Small Business Cybersecure Enclave Pilot Instruction document. This is a demonstration of an existing solution and demonstration of a full understanding of the technical requirements to attain an ATO. Also, fulfillment of the SOO. Please note Section 6 of the SOO, Use

Cases.

69. Question: Virtual demonstrations: For vendors presenting virtually, are live software demonstrations over DoD Teams permitted, and should any materials be submitted in advance?

Answer: You should demonstrate your solution as you see fit.