Questions to post in SAM 21 Oct 2026 .pdf

STAR-FISH CALL 017 - Secure By Design, FA9453-21-S-0001 – Questions sessions for 22 Oct

2026 at 0900 MNT.

• Could Attachment 2 be updated to CALL 017 instead of Call 013.

o Yes, have added updated WORD and PDF version into CALL.

• Can the Government please provide a template in Word format? Formatting and spacing is affected when we export from a PDF to Word and we don't want to be penalized for adjusting the format.

o Updated

• The draft DD Form 254 provided is blank. Will the government provide a draft DD-254 that is filled out prior to white paper due date?

o No, this is DD 254 is a ‘draft’ place holder as of right now as the classification depends on the white paper responses.

• CALL 017 submission instructions: Will consolidated written responses to all offeror questions be posted to SAM.gov, and by what date? Given the 17 Sep Q&A and 12 Oct deadline, we request posting no later than 26 September 2026. YES, consolidated questions will be posted to the announcement for all parties to view.

• Our team will like to know if we can submit a White Paper without a ROM in reference to the subject solicitation? YES

SOO 1.0 The purpose statement lists PNT, MW/MT, ISR, and

SATCOM. These represent different bus classes, orbits, contact profiles, crypto postures, latency requirements, and ground architectures. Is there a single primary reference mission, or is the flat-sat expected to be mission-agnostic? The mission and

SV bus will target P-LEO. The flat-sat should be partially representative of a on-orbit SV. A already built SV and Flat-sat are appropriate. The flat-sat should have a fidelity that allows for cyber experimentation but not fully model the actual SV.

The flat-sat will need to be hardware based at core but can have simulated and/or emulated subsystems and payloads.

SOO 1.0, 4.0 What capability will the Government possess at the conclusion of Phase IV that it does not possess today? The SOO defines activities and reports but not the resulting operational capability, its owner, or its operational home.

The government will poses a cyber-hardened flat-sat and space vehicle. The capability is mission assurance in a cyber-contested env. Red-teaming will be a major part of determining the MOPs, etc. The government has flexibilities to select red-team or evaluator.

SOO 4.0 What Measures of Effectiveness and Measures of Performance will be used to determine that "secure by design" has been achieved? No MOEs or MOPs appear in the SOO, the CALL, or Section C of the draft RFP.

Function, Performance, and cyber-effectiveness. Time to detect, time to characterize, time to respond, time to recover, positive vs negative detection are just some of the parameters.

SOO 2.0 Will the Government furnish a validated threat model, adversary capability baseline, or intelligence-informed threat assessment as GFI? Phase II requires development of cyber-attack scenarios and evaluation of defensive effectiveness against a baseline.

The government will rely on other government intel organizations to provide this to the AFRL government team and selected red-team.

SOO 2.0 Are prior AFRL, MIT Lincoln Laboratory, or Aerospace

Corporation vulnerability assessments of comparable space vehicles available to the awardee as GFI?

The selected red-team and evaluators who have a need to know for this phase of the project. This may not be the prime.

SOO 2.0 vs. 5.0/6.0 Section 2.0 states the project will "reduce the attack surfaces of space vehicles." Sections 5.0 and 6.0 address only flight software. Is attack surface reduction limited to flight software, or does it extend to bus avionics, payload, RF front end, onboard networks, and the ground segment?

Applied to space vehicle only. Will at minimum include core

FSW and avionics and may include payloads as seen fit by government.

SOO 1.0; CALL 4.0 Who is the intended transition recipient of the resulting capability? Is there an identified operational sponsor, program office, or follow-on program of record?

The 1st consumer of this projects results is AFRL/RJ who are still conducting a R&D effort with this project. Which is to understand how cyber-hardening and cyber defense will affect mission operations. Results controlled by the government will feed into Gov Ref Architecture for space vehicle cybersecurity and into transitions to DoW and/or Industry.

SOO (not specified anywhere)

What is the reference space vehicle form factor: 3U, 6U, 12U, ESPA-class, ESPA Grande, or a larger bus?

TBD. Depending on whitepaper proposals. However, targeting

P-LEO constellation SV’s is a good place.

SOO (not specified anywhere)

What orbital regime is assumed: LEO, MEO, GEO, HEO, or cislunar?

LEO

SOO (not specified anywhere)

What flight processor and instruction set architecture should the flat-sat use: LEON3/LEON4 (SPARC), RAD750

(PowerPC), ARM Cortex, RISC-V, or other? Is processor selection constrained by CHSS compatibility?

Modern RAD-Tolerant (target P-LEO). Not SPARC and or

RAD750. TBD.

SOO (not specified anywhere)

What operating system or RTOS is required or assumed:

VxWorks, RTEMS, embedded Linux, FreeRTOS, seL4, or bare metal? Is this constrained by CHSS?

CHSS would be the primary operating system. However, non-critical FSW could be hosted in CHSS VM that hosts a Linux, for example, OS. TBD.

SOO 4.0, 6.0 What flight software framework is expected: NASA cFS, F

Prime, a Government-furnished baseline, or contractor-developed software? Is any existing FSW baseline available as

GFI?

TBD, but would naturally fall out of the SV selection.

SOO (not specified anywhere)

Which onboard data bus and interface standards must be represented: MIL-STD-1553, SpaceWire, CAN, I2C, SPI, SpaceVPX, or time-sensitive Ethernet? TBD, naturally fall out of SV selection.

What TT&C and RF architecture is assumed (S-band, X-band, Ka-band, optical crosslink), and what data link protocol governs (CCSDS TC/TM, AOS, USLP, proprietary)?

TBD, naturally fall out of SV selection. However, the plan is to have cross-links.

What cryptographic architecture applies to the flat-sat: NSA

Type 1, CCSDS SDLS, commercial/CSfC, or no cryptography in the flat-sat representation?

TBD. May be a software-based encryption. For experimentation on flat-sat the encryption requirement may be lowered or eliminated.

SOO (not specified anywhere)

Is cryptographic key management — key loading, rotation, and recovery from compromised or lost keys — within scope?

TBD. Most likely will be yes. Because the cyber-hardening must also include protection of data at rest and in motion.

SOO (not specified anywhere)

Are crosslinks, hosted payloads, or third-party spacecraft components part of the reference architecture?

Yes. In order to have good science experimentation, this SV should have a mission associated with it. Therefore will need the appropriate payloads, etc. Although at this time is TBD.

SOO title vs. 4.0 Option 2 Is the ground segment within scope, and to what depth? The

SOO is titled for a space vehicle, but the cyber range, CONOPS, COAs, and UI all imply ground-side capability.

Cyber-hardening of the ground segment is not in scope.

However, the cyber capability onboard the SV will need to communicate with the Ground C2. CONOPS, COAs, and UI will need to be developed, one of the core goals of this project.

Yes a UI is in scope to interact with the onboard capability.

CALL Full Text, ARA technology area

Is onboard autonomy or AI/ML within scope? The cited ARA technology area expressly includes "autonomy and on-board threat assessment algorithms to enhance satellite resiliency" and references ML and AI. The SOO does not mention autonomy.

Yes. Once CONOPs, COAs are developed. Another project goal is to see which ones make sense to be made autonomous and which can operate onboard.

SOO 1.0, 2.0 Are secure boot, cryptographically signed flight software updates, and firmware integrity verification expected design features of the flat-sat, or are these properties expected to be supplied by CHSS?

Will be supplied via CHSS.

SOO 4.0, Base Period The Base Period requires the contractor to "verify the functionality of selected space vehicle subsystems." Which subsystems are the selected subsystems, and who makes that selection?

A existing design of a space vehicle should be selected. We are not developing a SV for this project purposes

SOO 4.0, Base Period What fidelity is required of the flat-sat? The term spans everything from a bench of development boards and EGSE to a full flight-representative engineering model with flight processors, flight harnessing, and qualified components.

TBD. The flat-sat will not be an exact copy of the SV.

However, it needs to be enough fidelity to conduct the cyber experimentation within the relevant environment that assures the solution will integrate and work within the SV. The primary component is the flight computer and flight software. The SV subsystems and payload should be emulated and/or simulated as appropriate (TBD).

SOO 4.0 Base Period vs. 3.0 Is the contractor building a new cyber range, or integrating the flat-sat into an existing Government cyber range? The Base

Period directs construction of "a corresponding space vehicle cyber range," while 3.0 places T&E at the AFRL Kirtland SCR.

A cyber range for R&D purposes will be built around the flat-sat. This will be used to conduct the integration, T&E, CONOPs and COA development, AI/ML, etc.

SOO 3.0 "SCR" is used twice and is never expanded or defined anywhere in the package. Please expand the acronym and describe the facility's capabilities, utilization and scheduling constraints, network accreditation status, and the contractor access/badging process and lead time.

Space Cyber Resiliency (SCR).

SOO 3.0 Section 3.0 indicates the flat-sat is built at a contractor location, hardened at MIT LL, and tested at AFRL Kirtland — implying at least two relocations of an integrated hardware article. How many relocations are anticipated, and who bears transportation, insurance, and post-move re-verification cost?

The cyber-range/flat-sat in its complete form will exists at

Kirtland AFB. MITLL performing the cyber-hardening will only require the flight computer and flight software to perform their work.

SOO 5.0 Does the physical flat-sat transfer to MIT Lincoln Laboratory, or does MIT LL work from a delivered software image or a second hardware article? Section 5.0 states the contractor will not perform hardening "of the flat-sat and software," which appears to indicate MIT LL handles hardware.

See above.

SOO (not addressed) Is a digital twin, software-in-the-loop environment, or fully simulated environment required in addition to the physical flat-sat? NA

SOO 4.0 Base Period vs. 5.0 The Base Period directs the contractor to "initiate cyber-hardening of the space vehicle flight software utilizing CHSS."

Section 5.0 states "the contractor will not be performing the cyber-hardening of the flat-sat and software, MITLL will perform this task." Which governs?

Statement is clear.

SOO 5.0 What is the contractor's expected role in support of MIT LL's hardening activity? Hardening will foreseeably require source code delivery, build environment support, developer Q&A, defect triage, and regression testing — none of which is described or bounded.

Flight computer and FSW, including source code and documentation will be given to MITLL. The government will select the best organizations for individual tasks and/or phases to complete.

SOO 5.0; 4.0 Option 1 Who is responsible for re-integration and functional regression testing after MIT LL returns hardened software to the flat-sat?

TBD. The government will select the best organization for this.

SOO 4.0, Option 1 Who bears accountability if the hardened software fails functional or performance T&E? The contractor's Option 1 performance is measured against outcomes produced by software it neither develops nor controls.

TBD

SOO 4.0, Option 1 What performance overhead attributable to cyber-hardening is acceptable? Option 1 requires functional and performance T&E of the hardened solution against a non-hardened baseline but establishes no pass/fail threshold.

TBD. This is an R&D project. We are trying to find this out.

What is acceptable to mission.

SOO 6.0 What specific artifacts constitute the "CHSS interfaces and drivers" the Government will provide — interface control documents, API specifications, header files, compiled binary drivers, or source code? What is their classification level?

Appropriate artifacts will be provided to those that have a need to know.

SOO 6.0; Draft RFP Section

F

What is the Government's committed delivery date for the

CHSS interfaces and drivers, and will that date be incorporated into Section F of the resulting contract?

SOO 5.0, 6.0; Draft RFP

52.216-24

What is the Government's mitigation plan if delivery of CHSS interfaces and drivers, or the availability of MIT LL hardening support, is delayed? The prime cannot direct, schedule, or hold an FFRDC to a delivery commitment, yet the base and first option periods depend entirely on that organization's throughput.

The contractor does not necessarily need all or any of CHSS to perform its work. Interfaces would be available and those are already set.

SOO 5.0 How many hardening cycles are planned between the contractor and MIT LL, and what turnaround time per cycle should offerors assume?

TBD

SOO 5.0 Is there an approved alternative path if CHSS proves incompatible with the selected flat-sat architecture, is unavailable when required, or does not meet performance thresholds?

The goal of the project is to harden with CHSS.

SOO 5.0 Will the Government provide an interface agreement, MOA, or

ICD governing the contractor–MIT LL exchange, addressing software transfer mechanisms, version control, defect reporting, classification handling, and acceptance criteria?

Flight computer and FSW are selected because of compatibility with CHSS.

SOO 3.0, 5.0 Who holds integration authority when the space vehicle contractor, MIT Lincoln Laboratory, and the AFRL SCR each interact with the same hardware article? No integrating organization is named.

TBD. The government will be the main integrator directing contractors and all parties involved on potential awards.

SOO 5.0 Will MIT LL personnel require access to contractor proprietary flight software source code, and under what protective agreement?

Yes. Whatever is appropriate. Will also require support from contractor during the project

SOO 6.0 Beyond CHSS, are there other Government, FFRDC, or third-party technologies, facilities, or personnel on which contract performance depends? We request a complete dependency list identifying the responsible organization and required availability date for each.

TBD

Draft RFP Section I, FAR

52.249-14

Will delays attributable to MIT Lincoln Laboratory, the AFRL

SCR, or late delivery of GFI be treated as excusable delays under FAR 52.249-14? NA

CALL V.1 The CALL requires each offeror to perform and submit its own

OCI analysis. Does the Government consider an existing offeror relationship with MIT Lincoln Laboratory, or with the

CHSS technology, to create an actual or potential OCI for this

CALL?

NA

SOO 4.0, 6.0 Would the Government accept an approach in which flat-sat design and build proceed in parallel with CHSS availability, using stubbed or emulated CHSS interfaces, with a defined interface reconciliation task once actual artifacts are received?

No.

SOO 6.0 Section 6.0 states the Government "will provide requirements/information for the space vehicle contractor to design the flat-sat and then build it." No such requirements document is in the package. Will it be released prior to white paper submission, or at minimum prior to Step 2?

Existing SV designs should be put forth.

SOO 6.0 Will the Government provide an interface control document, command dictionary, telemetry dictionary, or reference architecture for the space vehicle?

No, the SV provider will.

SOO 6.0 Under what license terms and data rights will the CHSS interfaces and drivers be furnished?

CHSS is protected by the government. This is a R&D project to understand how cyber defenses work onboard a space vehicle.

Therefore, all results stay within the project and it is up to government on how they wish to distribute. CHSS and the resulting cyber-hardened flat-sat/range and SV are for industry to sell.

CALL 4.c, 4.d The CALL states base support and base facilities are not anticipated but may be provided on written request however

Att 3 SOO, section 3 states some work to be performed at

AFRL KAFB SCR. Can the call be modified to reflect the

SOO information? NA

SOO 4.0, Option 1 Who develops and who executes the cyber-attack scenarios? Is the contractor expected to perform red team execution, serve as blue team, act as white cell, or some combination? Will a

Government or third-party red team participate?

Most statements in this document assume one contractor is performing all phases/tasks, it will not. The government will select from the whitepapers the appropriate organization to perform the tasks. In this case cyber-attack developed could be accomplished by the government and/or NSA and/or a 3rd party. All this is TBD.

SOO 4.0, Option 1 (ROE not referenced)

Will the Government furnish Rules of Engagement, or is the contractor to develop them for approval? Specifically: is the contractor authorized to execute exploitation vs. demonstrate theoretical vulnerability; inject malformed commands or packets; generate spacecraft commands; induce denial-of-service conditions; modify flight software or firmware; and conduct destructive testing?

Contractor can provide to government for government to approve. The government will have existing exploitation and cyber-scenarios but will expand those based on the organization selected for perform these tasks.

SOO 4.0, Option 1 How is the "non-hardened baseline" established, configuration-controlled, and maintained? If MIT LL performs hardening, the contractor may not possess a configuration-controlled non-hardened twin at an identical build level.

The non-hardened FSW should exists, because this is what will be cyber-hardened with CHSS.

SOO 4.0, Option 1 Are RF transmissions authorized during testing, or must all link-layer testing be conducted via cabled and attenuated paths? If over-the-air testing is contemplated, what spectrum authorization authority applies and what is the lead time?

RF most likely not needed.

SOO 7.0 Section 7.0 states T&E results "may be held at SECRET." Does classified T&E require a contractor facility cleared for storage at the SECRET level, or will all classified work be performed at the AFRL SCR? At what point in the program does classified work begin? TBD.

SOO 4.0, Option 1 Will the Government identify systems, networks, or interfaces that are explicitly off limits to testing, and the approval chain and lead time required before each test event? TBD.

SOO 4.0, Option 2 For whom are the CONOPS and Courses of Action being written? Please identify the intended operational user — a specific Space Delta, squadron, satellite control center, or mission partner. Will operational SMEs participate in CONOPS development and the ground demonstration?

SOO 4.0, Option 2 What are the requirements for the user interface? Is this a standalone visualization tool, a plug-in to an existing

Government C2 baseline, or an integrated capability requiring its own ATO? Please identify target host environment, RMF/ATO obligations, applicable Government interface standards, and Section 508 applicability.

TBD

SOO 4.0, Option 2 What constitutes "Ground Demonstration Completion"? Please define the demonstration scenario, location, witnessing authority, and objective exit criteria.

TBD

SOO 4.0, Option 3 What space vehicle will fly in the on-orbit demonstration, and who provides it? No spacecraft, mission, rideshare arrangement, hosted payload agreement, or flight opportunity is identified anywhere in the package.

SV selected would be one that flies LEO in a P-LEO configuration.

SOO 4.0 Option 3; CALL

II.2

Who funds and procures launch services, launch vehicle integration, and range services for the on-orbit demonstration?

No launch cost appears in the FY27–FY30 funding profile.

TBD This is the point of the project.

SOO 4.0, Option 3 Is CHSS flight-qualified, and at what Technology Readiness

Level, for on-orbit operation? NA

SOO 4.0, Option 3 Who holds responsibility for licensing, orbital debris mitigation compliance (ODMSP), and frequency authorization for the on-orbit demonstration?

NA

SOO 4.0, Option 3 Will ground station services for the on-orbit demonstration be

Government-provided, commercially procured, or contractor-furnished?

NA

Draft RFP 252.204-7012, 252.204-7019

Does CMMC apply, and at what level? The draft RFP includes

DFARS 252.204-7012 and 252.204-7019 but not 252.204-

7021. Must a current SPRS score and a specified CMMC level be in place at proposal submission or at award?

Determination made before release of RFP.

CALL 3.d CALL 3.d cites AFRLI 161-113 and states RISC assessment attachments requiring completion will be provided "in the

RFP." These do not appear in draft solicitation

FA945326RX011. Will they be included in the released RFP?

Yes will be included in RFPs to selected white paper(s).

CALL 4.f CALL 4.f states: "Data Rights Desired: Unlimited Data Rights that may be required are Government Purpose Rights."

Unlimited Rights and Government Purpose Rights are distinct categories. Which does the Government require?

NA

CALL 4.f; SOO 4.0 Please specify the data rights category required separately for:

(a) flight software source code; (b) flat-sat design data and drawings; (c) cyber range architecture and configuration; (d) contractor-developed test tools, scripts, and harnesses; (e) the

Option 2 user interface; (f) contractor background IP incorporated into deliverables.

NA

SOO 5.0, 6.0 Is delivery of flight software source code to the Government a required deliverable, independent of the delivery required to

MIT Lincoln Laboratory for hardening?

TBD.

CALL II.2 Is the stated $14M anticipated funding the total available across all awards under this CALL, or the anticipated value of an individual award? What is the target value range for an individual award, and how many awards are anticipated?

Read call language for this.

CALL II.2 The funding profile shows FY27 $5M, FY28 $2M, FY29 $2M, FY30 $5M. Funding is lowest in FY28–FY29, which under

SOO phasing correspond to integration of hardened software, three T&E campaigns, CONOPS/COA development, UI development, and a ground demonstration. How should offerors reconcile the funding profile with the work profile?

NA

SOO 4.0 (no reviews identified)

Will the Government conduct formal technical reviews —

SRR, PDR, CDR, TRR? No technical reviews appear in the

SOO, the CALL, or the draft solicitation. Read call of selection criteria.

3. Please confirm the current version and date of the STAR-FISH White Paper Template.

Updated

4. Does the government require a specific format for the ROM, or a ROM by phase or CLIN?

Structure and funding

5. The call text says base plus two options. The SOO says base plus three options. Which structure applies? This is a typo, please ignore, and refer to phase language in the call.

6. The $14M funding is for the whole call. Does the government expect one award to cover all

SOO phases, or separate awards for parts of the SOO? Per the call the government has the right to award one, multiple or none.

Scope

7. For the on-orbit demonstration, will the government provide a host vehicle? If yes, which one?

Who funds integration and launch? TBD

8. When will offerors receive the flat-sat requirements (GFI), and the CHSS interfaces and drivers? TBD

9. How will the contractor coordinate with MIT Lincoln Laboratory? Does the government require an associate contractor agreement? TBD

10. Does the flat-sat stay at the contractor site, or does it move to KAFB? Does it become government property under the CAP provisions? TBD

11. Does the flat-sat need to be in a SECRET approved room for operation? NA

Business systems and terms

12. The call requires an approved accounting system. Does a successful pre-award accounting system survey meet this requirement? Will the government consider a different instrument type for an offeror whose system is in review? Could we bid this FFP? Yes you can bid as FFP the call relays that if a cost reimbursement contract is anticipated an approved accounting system is required.

13. The call states that the government wants Government Purpose Rights. May offerors assert restrictions on background IP developed at private expense? Yes

14. May offerors contact the Technical Manager during the white paper period? Please do not contact them, provide correspondence to the contracting team if related to this call.

15. Could the government use a CRADA or existing vehicles for the SCR program: No other contract vehicles are anticipated to be a part of SCR at this time.

1. The SOO states that MITLL will take the vendors software and do the cyber hardening. I will likely not get permission to share our software directly with MITTLL. Therefore, is it possible for us to propose working directly with AFRL on how to interface CHSS with our autonomy? Yes

2. How important is it to follow the 4 phase, 51-month PoP in the SOO? Can we suggest a faster implementation and demonstration phases of schedule – understanding that the on-orbit experimentation will still be subject to the launch date? Yes you could suggest a faster implementation and demonstration phase.

1. Currently the STAR FISH Call is open to all sizes – large / small businesses. Yes

2. Whether a company without an FCL can respond at the white-paper stage for that limited scope, and which company-eligibility and personnel requirements must be established at this stage. Yes

3. Since we are a software provider, I wanted to see if an established teaming agreement/LOI with a bus manufacturer would be necessary for us to respond to the ARA at this point, or if AFRL had target integrations in mind for CHSS? This is an option if you feel it meets the call announcement the best for your organization.