RFI FNA-CPO-0126 Amendment 004.pdf

Data Verification and Validation Link Analysis Software Platform – Artificial Intelligence (AI) Solutions for Network Performance Analytics and Data Validation

RFI FNA-CPO-0126

Amendment 004

1 | P a g e

The purpose of this amendment is to extend the close date of the RFI and respond to questions posed. The close date for the RFI is hereby extended from January 30, 2026 5:00 pm ET to February 6, 2026 5:00 p.m. ET.

The following questions and responses are hereby provided –

Question 1: I'm just trying to figure out the situation with this opportunity, and whether it's still viable, and if it's subject to funding cuts like many programs have?

Response 1: As noted within the Request for Information (RFI) documentation, the RFI is for planning purposes only and is not a Request for Proposal (RFP)/Request for Quotation (RFQ) or an obligation on the part of the FirstNet Authority for conducting a follow-on acquisition.

Question 2: After reviewing the Draft PWS for the Data Verification and Validation Platform, I noticed that Section 3.10 specifies that the solution must be hosted in a FedRAMP certified AWS GovCloud environment. Could you share additional context on why AWS GovCloud is mandated for this requirement?

Response 2: The Office of the Chief Information and Data Officer (OCIO) mandates FedRAMP Moderate authorized hosting environments to ensure alignment with federal RMF requirements, enterprise risk tolerance, and FirstNet Authority ATO processes. AWS GovCloud is identified in Draft PWS as the reference environment due to its established FedRAMP authorization, federal service maturity, and compatibility with OCIO security tooling and continuous monitoring processes.

That said, OCIO recognizes that equivalent FedRAMP Moderate authorized cloud service providers may be capable of meeting mission, security, and authorization requirements. At this stage, industry feedback on alternative FedRAMP Moderate environments is acceptable, provided vendors demonstrate portability, supportability of OCIO ATO artifacts, and full compliance with federal cybersecurity requirements. Final hosting determinations will be made in the solicitation phase.

Question 3: Is there an incumbent contract/task order number which you could provide?

Response 3: Government Acquisitions Inc.; task order number NNG15SD23B/ 1333P224F00000028

Question 4: Can you provide inventory of existing Palantir Foundry assets (ontologies, pipelines, datasets) that require migration?

Response 4: A detailed inventory (e.g., ontologies, pipelines, datasets, dashboards, and metadata) will be provided, as appropriate, upon award of any future solicitation/transition artifacts. Per the PWS, the incoming contractor shall validate and migrate existing AI/LLM/ML models and dashboards, historical datasets, and platform configurations/user roles as part of a seamless transition. Respondents should describe methods to ingest, preserve, and/or refactor these assets

Data Verification and Validation Link Analysis Software Platform – Artificial Intelligence (AI) Solutions for Network

2 | P a g e with minimal operational disruption, and note any dependencies or proprietary constraints that may impact portability.

Question 5: What are the primary drivers for exploring alternative platforms?

Response 5: The primary drivers for FirstNet Authority to continuously mature and optimize its network performance analytics and data validation capabilities include:

• Cost Efficiency and Sustainability: Reducing long-term operational costs and minimizing vendor lock-in to ensure financial predictability.

• Enhanced Data Portability and Interoperability: Improving the ability to migrate, share, and integrate data across multiple systems and environments without proprietary constraints.

• Advanced Analytics and AI/ML Capabilities: Enabling modernized analytics, predictive modeling, and AI-driven insights to support evolving mission needs.

• Scalability and Performance: Supporting anticipated growth in data volume and complexity while maintaining high performance and responsiveness.

• Compliance and Security: Meeting or exceeding FedRAMP and FirstNet-specific cybersecurity requirements, while ensuring auditability and governance.

• User Experience and Workflow Optimization: Delivering intuitive tools and streamlined processes to improve efficiency for analysts and decision-makers.

Question 6: Are there specific Palantir Foundry capabilities or integrations that must be preserved?

Response 6: The Government expects to preserve certain mission-critical capabilities and integrations from the current Palantir Foundry implementation to ensure continuity and minimize operational disruption. These include:

• Core Ontologies and Data Models: Foundational structures that support analytics and reporting workflows.

• Existing Data Pipelines: High-value ingestion and transformation pipelines that enable timely and accurate data processing.

• Dashboards and Visualizations: Key dashboards used for operational decision-making and compliance reporting.

• Integration with Microsoft Azure Services: Current interoperability with Azure-based storage, compute, and identity management.

• Security and Compliance Features: FedRAMP Moderate controls and audit capabilities embedded in the incumbent environment.

While modernization and optimization are anticipated, these components should be preserved or replicated with minimal modification to maintain continuity of critical functions.

Question 7: What data export formats are currently available from the incumbent platform?

Response 7: The incumbent platform, Palantir Foundry, supports multiple export formats to enable data portability and integration. Currently utilized formats include, but are not limited to:

Data Verification and Validation Link Analysis Software Platform – Artificial Intelligence (AI) Solutions for Network

3 | P a g e

• CSV (Comma-Separated Values): For tabular datasets and structured data.

• Apache Parquet and JSON

• Microsoft Office Formats:

o Excel (.xlsx): For spreadsheet-based analysis and reporting.

o Word (docx): For documentation and narrative reports.

o PowerPoint (.pptx): For presentation-ready summaries and visualizations.

Question 8: Can we request the name of the incumbent vendor and their contract number, considering they are currently under performing?

Response 8: Reference Response 3.

The Government has not given any indication the incumbent is underperforming.

Question 9: What is the total award value of the ongoing contract held by the incumbent vendor?

Response 9: $6,022,355.88

Question 10: RFI : Objectives of this RFI : Paragraph 1 – It is unclear from the two sentences in this paragraph whether the current system (Microsoft Azure data and Palantir Foundry) will be replaced entirely with the new solution, augmented (added to) by the new solution, or something in between. RFI Response items 2.b., 2.e., and 4.a. similarly imply conflicting TO BE states for the desired solution. Please clarify.

Response 10: The Government is currently conducting market research. At this stage:

• No Decision on Full Replacement vs. Augmentation: The RFI seeks industry input to evaluate options ranging from full platform replacement to hybrid approaches that coexist with the current Microsoft Azure and Palantir Foundry environment, if possible.

• Exploration of Alternatives: Responses shall address both scenarios—complete transition and augmentation—highlighting trade-offs in cost, risk, and operational continuity.

• Focus on Flexibility and Portability: Any proposed solution shall prioritize interoperability, data portability, and minimal disruption to mission-critical workflows.

• Objective: Gather insights on technical feasibility, scalability, and compliance implications for each approach to inform future acquisition strategy, if pursued.

Question 11: DPWS : Section 1 Purpose : Paragraph 2 – The term ‘contractor-submitted’ is used to describe the datasets. Please clarify what is meant by ‘contractor-submitted.’ Is the contractor chosen to deploy the subject system of this RFI the same as the contractor submitting the datasets?

Response 11: FNA has multiple vendors that provide deliverables requiring verification and validation (V&V) for contract oversight. The AI platform is being utilized to enhance and accelerate this V&V process by introducing advanced automation and analytics capabilities.

Examples include, but are not limited to:

Data Verification and Validation Link Analysis Software Platform – Artificial Intelligence (AI) Solutions for Network

4 | P a g e

• Automated Data Integrity Checks: AI algorithms can quickly validate data accuracy and completeness against predefined standards.

• Anomaly Detection: Machine learning models identify irregularities or deviations in deliverables that may indicate compliance issues or performance risks.

• Natural Language Processing (NLP): AI can review (e.g., compare, merge, diff), summarize large volumes of documentation, flagging inconsistencies or missing elements.

• Predictive Analytics: AI-driven insights help anticipate potential quality or compliance issues before they occur, reducing oversight cycle time.

• Workflow Optimization: Intelligent routing and prioritization of V&V tasks based on risk profiles and historical patterns.

These capabilities collectively improve efficiency, reduce manual effort, and strengthen oversight accuracy across multiple vendor deliverables.

Question 12: DPWS : Section 3.6 AI/ML Transition – Major bullet 1 and all of its sub-bullets are confusing as to whether the incoming contractor is the receiver or provider of the items requested. Please clarify.

Response 12: The incoming contractor is expected to receive transition artifacts from the incumbent provider and then provide the necessary deliverables to ensure continuity and modernization. Specifically:

• Receiver Role: The contractor will obtain existing AI/ML models, pipelines, and documentation from the incumbent as part of transition-in activities.

• Provider Role: The contractor is responsible for validating, refactoring, and enhancing these assets as needed, and for delivering updated models, workflows, and supporting documentation to the Government during performance.

• Key Expectation: The contractor must ensure seamless integration of inherited components into the new platform while meeting all compliance, performance, and security requirements outlined in the PWS.

This dual role ensures that the transition minimizes disruption while enabling modernization and improved analytics capabilities.

Question 13: DPWS : Deliverables Table : Transition Plan & Schedule – The term ‘incumbent’ seems to be used to refer to two different contractors: 1) for Phase-In (Transition In), incumbent refers to the current solution contractor; and 2) for Phase-Out (Transition Out, incumbent refers to the contractor who will deliver the new AI system, and was the one who received the transition from the incumbent in Phase-In. Please validate that is a correct interpretation.

Response 13: Yes, that interpretation is correct. During Phase‑In (Transition‑In), “incumbent” refers to the outgoing provider of the current solution from whom transition artifacts are received. During Phase‑Out (Transition‑Out) at contract completion, “incumbent” refers to the contractor performing under the new award who must prepare for a seamless handover. This aligns with PWS §3.6 (AI/ML Transition)—which requires coordination with the outgoing

Data Verification and Validation Link Analysis Software Platform – Artificial Intelligence (AI) Solutions for Network

5 | P a g e contractor and validation/migration of existing models and dashboards—and the Deliverables— Transition Plan & Schedule (Phase‑In initial with proposal, finalized within 15 days after award;

Phase‑Out initial within 90 days of contract end, finalized within 60 days).

Question 14: DPWS : Deliverables Table : Transition Plan & Schedule – Phase-In must be completed 15 days after award. Are those 15 calendar days? Does the contract end for the incumbent contractor 15 days after award or does it continue to some other milestone? Post Phase-In, will the incoming contractor be responsible for operating the legacy system(s) or will they be turned off at that time?

Response 14: 15-=days after award is reflected in calendar days. Legacy operations continue during transition; the PWS requires platform delivery within 90 days of award and a seamless transition with validation/migration before cutover—legacy systems are not turned off at Phase‑In completion unless directed by the Government. Phase‑Out planning is addressed near contract end (initial within 90 days of contract end; finalized within 60 days).

Question 15: Based on our review of the PWS and the stated objectives (including data rights, portability, auditability, and sustainment of existing Government-owned analytics), we interpret that the Government may be evaluating potential solutions along several primary drivers. For validation, we would appreciate your guidance on whether the following characterizations are directionally correct, and—if so—whether the Government is able to indicate a relative order of importance among them:

• Option A: Safest approach for audit defensibility, data portability, and long-term cost control

• Option B: Strongest SQL-centric governance and reporting capability, with somewhat greater OEM dependency

• Option C: Strong AI/ML modernization and advanced analytics capability, with increased complexity in demonstrating reduced vendor lock-in

Response 15: Your characterizations are directionally consistent with Government drivers (auditability, data rights/portability, cost control, and AI/ML modernization). At the RFI stage, the Government is not ranking these dimensions; the RFI objectives seek FedRAMP Moderate compliant solutions that support sustainment, transition, reuse, and enhancement of existing capabilities while minimizing disruption and risk. Responses shall emphasize data rights and portability (PWS §3.8), security/compliance (PWS §3.10), and reuse/migration of Government‑owned assets (PWS §3.6), while articulating modernization trade‑offs.

Question 16: AI/ML Model

Section 3.9 of the Draft PWS indicates that Government review and approval are required prior to deployment of AI/ML model updates. Can the Government clarify whether this requirement applies to all model changes, including routine retraining, parameter tuning, and performance optimization, or only to material changes that alter analytic logic, outputs, or decision methodologies?

Data Verification and Validation Link Analysis Software Platform – Artificial Intelligence (AI) Solutions for Network

6 | P a g e

Response 16: The Government review and approval requirement primarily applies to material changes that impact analytic logic, outputs, or decision-making methodologies. Examples include, but are not limited to:

• Introduction of new models or significant architectural changes.

• Modifications that alter predictive logic, risk scoring, or compliance-related outputs.

• Updates that affect auditability or regulatory adherence.

Routine activities such as model retraining, parameter tuning, and performance optimization— when performed within previously approved frameworks and without altering core logic—are generally considered operational maintenance and may not require formal approval.

Question 17: Migration of Existing AI Models

Can the Government clarify how many existing AI or machine learning models are expected to be migrated as part of this effort, and whether any of these models are custom-developed and not commercially available off-the-shelf?

Response 17: The exact number of AI/LLM/ML models and their complexity are under assessment and will be detailed, if applicable, in any future solicitation. Per the PWS, the contractor shall validate and migrate existing AI/LLM/ML models and dashboards, along with historical datasets and configurations, as part of a seamless transition from the incumbent environment. The RFI notes the Government currently operates an existing analytics platform (Azure database + Palantir Foundry) with Government‑owned integrations, workflows, and user‑facing applications, which respondents should plan to sustain, transition, reuse, and enhance.

Question 18: Use of AI for Meeting Recordings and Minutes

Can the Government clarify whether it is acceptable for the Contractor to record meetings and utilize AI-enabled tools to generate meeting minutes or summaries, subject to applicable privacy, security, and data handling requirements?

Response 18: Recording meetings and use of AI enabled transcription or summarization tools is generally prohibited unless explicitly approved by the Contracting Officer or COR.

Any approved recordings must be hosted within Government-controlled environments and comply with OCIO privacy, cybersecurity, and data handling requirements. Routine meetings should not be recorded, and contractors must ensure that no AT&T sensitive data, CUI, or protected information is improperly captured, stored, or transmitted.

Question 19: Performance SLAs for Advanced Analytics

Section 3.7 specifies an average user query response time of two (2) seconds. Can the Government clarify whether this service level requirement applies to all analytic workloads, including LLM-based semantic queries, large-scale historical modeling, and advanced geospatial

Data Verification and Validation Link Analysis Software Platform – Artificial Intelligence (AI) Solutions for Network

7 | P a g e analysis, or whether it is intended to apply specifically to standard dashboards and structured query use cases?

Response 19: The 2‑second average response time under normal load is intended for interactive user queries (e.g., standard dashboards and structured queries). For compute‑intensive workloads—such as LLM‑based semantic queries, large‑scale historical modeling, or advanced geospatial analyses—performance targets should be defined per use case and measured through the acceptance criteria and UAT processes in PWS §3.12.

Question 20: Commercial Network Benchmarking Data Sources

Section 3.2 requires benchmarking of NPSBN performance against commercial networks. Can the Government clarify whether authoritative benchmarking datasets will be provided by the Authority (e.g., FCC, crowdsourced, or other Government-furnished sources), or whether the Contractor is expected to independently acquire, license, and integrate third-party commercial carrier performance data?

Response 20: The PWS envisions benchmarking NPSBN performance against commercial networks and integration of geospatial datasets (e.g., FCC coverage maps, GIS layers). RFI references carrier‑provided network/cybersecurity data and crowd-sourced data. Where Government‑furnished datasets are available (e.g., FCC), the Government will provide or direct their use; however, vendors should be prepared to identify, license, and integrate third‑party benchmarking datasets if required to meet analytics objectives. All licensing will be purchased via separate solicitation.

Question 21: Government SME Support for Analytics and Modeling

Can the Government clarify whether it will provide subject matter experts (SMEs) with sufficient knowledge of the required datasets and appropriate analytical or predictive modeling approaches for each use case, with the Contractor responsible primarily for implementation, or whether the Contractor is expected to determine both the analytical approach and model selection in addition to implementation?

Response 21: The Government will provide product ownership and stakeholder engagement to support requirements elicitation, UAT, and acceptance. However, the Contractor is expected to lead the analytical approach and model selection, implement pipelines/models, and demonstrate performance against use‑case acceptance criteria (accuracy, precision/recall, etc.). This is executed within the agile cadence (two‑week sprints, bi‑monthly UATs) and documented via the Use Case Delivery Plan.

Question 22: Crowdsourced Data Sources

Can the Government clarify whether crowdsourced data sources required for the solution will be Government-furnished, or whether the Contractor is expected to independently identify, acquire, license, and integrate applicable crowdsourced datasets?

Data Verification and Validation Link Analysis Software Platform – Artificial Intelligence (AI) Solutions for Network

8 | P a g e

Response 22: No, the Government will furnish authoritative datasets (e.g., FCC coverage maps, GIS layers) and carrier‑provided data where available. To meet benchmarking and analytics objectives, vendors should be prepared to identify, license, and integrate applicable crowdsourced datasets when Government‑furnished information is insufficient or when commercial sources provide greater granularity or coverage. Final source provisioning will be clarified in any future solicitation.

Question 23: Real-Time Data Latency

The Draft PWS references “real-time” data ingestion and analytics. Can the Government clarify the expected data latency associated with “real-time” data (e.g., seconds, minutes, or near-real-time intervals such as 5 minutes or 15 minutes)?

Response 23: The PWS requires support for real‑time and batch processing but does not prescribe a fixed latency window. Latency targets will be defined per use case (e.g., streaming telemetry vs. executive dashboards). Respondents should propose pragmatic near‑real‑time targets (e.g., sub‑minute to ~5–15 minutes, depending on data source velocity, analytic complexity, and SLA impacts) with monitoring and scale‑out strategies to maintain performance.

Question 24: Acquisition Pathways

Will the Government consider acquisition approaches that prioritize continuity and speed to impact, such as 8(a) sole-source pathways, where the contract value and mission risk profile support such an approach?

Response 24: Reference Response #1. Given this RFI is market research planning purposes only, the Government is unable to speak on acquisition strategies for any potential subsequent solicitation.

Further reference RFI Response Instructions.

Question 25: Privacy and Regulatory Compliance Responsibilities

Can the Government clarify whether privacy, data governance, and cybersecurity requirements for each dataset are predefined and provided by designated Government data owners, or whether the Contractor is responsible for determining and applying applicable regulatory, statutory, and policy requirements for each dataset?

Response 25: OCIO retains enterprise authority over cybersecurity, privacy, and data governance enforcement. While Government data owners will validate dataset-specific governance and mission use, the Contractor is responsible for implementing, documenting, and maintaining compliance with all applicable federal laws, regulations, and standards across the system boundary.

Data Verification and Validation Link Analysis Software Platform – Artificial Intelligence (AI) Solutions for Network

9 | P a g e

This includes, but is not limited to, FISMA, NIST SP 800-53, FedRAMP Moderate controls, privacy requirements, and OCIO directed RMF artifacts. Contractors must apply appropriate safeguards to all data, regardless of source, and support OCIO-led ATO processes, continuous monitoring, and incident response requirements, including one-hour notification of suspected breaches.

Question 26: Cybersecurity Validation Requirements

Can the Government clarify the specific cybersecurity validation activities required for the system, including any assessments, authorizations, audits, penetration testing, or continuous authorization processes beyond standard FedRAMP requirements?

Response 26: Beyond baseline FedRAMP requirements, the system must undergo OCIO directed cybersecurity validation activities aligned with FirstNet Authority RMF implementation.

Contractors shall support security assessment and authorization activities, including SSP development, SAP/SAR support, POA&M creation and remediation tracking, and ongoing security control testing.

OCIO requires continuous monitoring implementation, periodic control validation, and compliance reporting consistent with enterprise ConMon strategy. Independent assessments, penetration testing, and vulnerability scanning may be required at OCIO discretion to address risk posture and authorization decisions.

Question 27: Dashboard Requirements Definition

Can the Government clarify whether dashboard requirements, metrics, and visualizations are fully defined and documented, or whether the Contractor is expected to collaborate with stakeholders to elicit, refine, and define dashboard requirements during performance?

Response 27: Dashboard requirements are not fully pre‑defined; the Contractor will collaborate with stakeholders to elicit, refine, and document requirements during performance. The PWS prescribes an agile approach (two‑week sprints, bi‑monthly UATs) and requires a Use Case Delivery Plan (business requirements, data sourcing/validation, model development/testing, metrics/reporting) with recurring ceremonies and backlog management.

Question 28: FirstNet Continuous Monitoring and Incident Response

Can the Government clarify whether FirstNet imposes continuous monitoring, incident response, or security requirements that exceed FedRAMP Moderate baselines, and if so, identify the applicable standards or policies.

Response 28: AWS GovCloud is referenced in Draft PWS as a guideline to illustrate the baseline FedRAMP Moderate security posture required for this capability and to provide a common federal reference environment. The intent is not to prescribe a single cloud service provider, but

Data Verification and Validation Link Analysis Software Platform – Artificial Intelligence (AI) Solutions for Network

10 | P a g e to ensure that proposed solutions meet federal FedRAMP Moderate requirements and RMF alignment.

Beyond baseline FedRAMP requirements, the system must undergo OCIO directed cybersecurity validation activities aligned with FirstNet Authority RMF implementation. Contractors shall support all required security assessment and authorization (A&A) activities, including development and maintenance of the SSP, SAP/SAR support, POA&M creation and remediation tracking, and ongoing security control testing and validation.

OCIO requires implementation of continuous monitoring (ConMon), periodic control reassessment, and compliance reporting consistent with the enterprise ConMon strategy. At OCIO discretion, independent security assessments, penetration testing, vulnerability scanning, and other validation activities may be required to assess system risk posture and support authorization decisions.

Question 29: Issue Priority Definitions

Can the Government provide definitions for Critical, High Priority, Medium Priority, and Low Priority issues, including associated response times, resolution expectations, and escalation procedures?

Response 29: The PWS prescribes SLA response and resolution times for Critical, High, Medium, and Low issues (e.g., Critical: 1‑hour response / 4‑hour resolution; High: 4 hours / 1 business day; Medium: 1 business day / 3 business days; Low: 2 business days / 5 business days) and requires an incident response and escalation structure. Specific priority definitions (e.g., what constitutes “Critical” vs. “High”) will be finalized with the Government during onboarding and included in the Program Management and Incident Response procedures.

Question 30: Can the Government clarify its expectations for recurring and ad hoc deliverables under the PWS, including:

• How recurring deliverables are defined (e.g., reports, dashboards, briefings, compliance artifacts), along with their expected frequency and level of effort

• How the Government generally characterizes ad hoc deliverables and whether there is an anticipated volume over the course of performance

• How ad hoc requests will be prioritized and managed relative to planned work, including whether they are expected to be handled within the base scope or through a separate change or tasking mechanism when they exceed an agreed threshold.

Response 30: Recurring deliverables include but are not limited to: Weekly meetings and agendas/minutes, Monthly Reports & Schedules (analytics/system performance/risks/security), Quarterly Analytics Reports, Sprint‑based use case metrics, Performance Metrics Dashboard, and Executive‑level analytics. Ad hoc deliverables include executive requests with response within 24 hours and delivery within 5 business days, with a maximum of ten (10) per quarter. Ad hoc

Data Verification and Validation Link Analysis Software Platform – Artificial Intelligence (AI) Solutions for Network

11 | P a g e requests are managed within the agile cadence and prioritized with the COR/PM; when they exceed agreed thresholds, they may be tasked separately by mutual agreement.

Question 31: Does the FirstNet Authority envision a future acquisition that prioritizes enhancement and coexistence with the current Azure and Palantir Foundry environment, or is the Government exploring longer-term platform consolidation options?

Response 31: No decision has been made. The RFI seeks input on how FedRAMP Moderate compliant solutions could sustain, transition, reuse, and enhance existing capabilities (Azure/Foundry) while minimizing disruption. The Government is conducting market research for both hybrid coexistence and long‑term consolidation options and invites respondents to outline trade‑offs. (See also Q&A Response 10, noting no decision on full replacement vs.

augmentation.)

Question 32: Is the primary objective of this RFI to inform sustainment of the existing analytics ecosystem, or to assess market readiness for a potential competitive transition over time?

Response 32: The primary purpose of this RFI is market research to understand commercial, FedRAMP Moderate solutions that can support sustainment, transition, reuse, and enhancement of existing capabilities—informing both near‑term sustainment and potential competitive transition pathways.

Question 33: How should respondents balance innovation versus operational risk in their responses—particularly where novel AI approaches may introduce changes to existing workflows?

Response 33: Respondents should propose innovative AI/ML capabilities while demonstrating operational risk controls, including: Change management with version control, documentation of changes, benchmarks, validation results; Government review/approval of material model changes; UAT and acceptance criteria per use case; ConMon and incident response. Phased pilots with clear rollback plans are recommended to minimize disruption to mission‑critical workflows.

Question 34: Can the Government clarify the extent to which existing Government-owned data pipelines, analytic logic, and dashboards are expected to be reused versus refactored in a future solution?

Response 34: The Government expects maximum feasible reuse of Government‑owned data pipelines, analytic logic, dashboards, and workflows; however, refactoring may be required to meet performance, portability, or compliance objectives. Contractors shall validate and migrate existing assets (models/dashboards/datasets/configurations) and identify any proprietary constraints impacting access or portability, proposing mitigation strategies and export in common formats as needed.

Data Verification and Validation Link Analysis Software Platform – Artificial Intelligence (AI) Solutions for Network

12 | P a g e

Question 35: Are there specific components of the current Palantir Foundry implementation that the Government considers mission-critical and therefore expects to be preserved with minimal modification?

Response 35: The Government anticipates preserving mission‑critical components to ensure continuity, including: core ontologies and data models, high‑value data pipelines, operational dashboards/visualizations, current Azure interoperability, and embedded security/compliance features. These shall be preserved or replicated with minimal modification while meeting the PWS’s transition and compliance requirements.

Question 36: Are there specific AI/ML use cases (e.g., anomaly detection, predictive performance degradation, cross-carrier benchmarking) that the Government considers higher priority than others?

Response 36: The Government is prioritizing AI/ML use cases that directly support mission-critical objectives and operational efficiency. High-priority examples include but are not limited to:

• Anomaly Detection: Identifying irregularities in network performance, cybersecurity events, or data integrity to enable rapid response and risk mitigation.

• Predictive Performance Degradation: Forecasting potential network or system failures to proactively address issues before they impact service availability.

• Cross-Carrier Benchmarking: Comparing NPSBN performance against commercial networks to ensure compliance with service-level expectations and optimize investments.

• Capacity Planning and Resource Optimization: Leveraging predictive analytics to anticipate demand spikes and allocate resources efficiently.

• AI-Driven Quality Assurance for V&V: Automating verification and validation of vendor deliverables to accelerate oversight and improve accuracy.

These use cases align with FirstNet’s goals of improving reliability, security, and operational readiness for first responders.

Question 37: Does the Government have a preference for explainable and auditable AI models over more complex black-box approaches, particularly given oversight and regulatory considerations?

Response 37: Yes. Given oversight and regulatory considerations, the Government prefers explainable and auditable AI models, supported by documentation, benchmarks, validation results, and audit logging. More complex (“black‑box”) approaches may be considered if they are accompanied by robust governance, monitoring, and evidence of control effectiveness within the Change Management and Use Case Acceptance processes.

Question 38: Can the Government provide additional context on the expected scale, velocity, and variability of carrier-provided and cybersecurity datasets to be analyzed?

Data Verification and Validation Link Analysis Software Platform – Artificial Intelligence (AI) Solutions for Network

13 | P a g e

Response 38: The platform must support real‑time and historical analytics from 2017 to present, with initial data volumetrics are expected to start at approximately 5 TB and scale to ~150 TB (TBR). Respondents shall propose a tiered pricing approach aligned with anticipated growth milestones (e.g., 5 TB, 50 TB, 100 TB, 150 TB) to ensure cost predictability and scalability.

Pricing tiers shall include storage, compute, and performance SLAs, with options for on-demand expansion.

KPIs include throughput, latency, jitter, packet loss, availability/reliability, adoption/churn, RF coverage (indoor/outdoor), temporary coverage/RTOs, call success rate, session drops, with spatial/temporal granularity down to census block or geohash. Vendors should plan for high variability (structured/unstructured, geospatial layers, carrier/cybersecurity feeds, crowdsourced data) and scalability across storage/compute tiers.

Question 39: For vendors that are FedRAMP Moderate authorized at the platform level, are there specific additional security controls or Authority to Operate (ATO) expectations unique to FirstNet’s operating environment?

Response 39: Possession of a FedRAMP Moderate authorization does not eliminate the need for FirstNet specific authorization activities. Vendors must integrate their platform into the FirstNet Authority security boundary and support OCIO defined controls, documentation, and operational security processes.

Additional expectations may include boundary definition, inheritance validation, integration with OCIO security tooling, enhanced logging and audit requirements, and participation in OCIO directed assessments. Final ATO determinations remain the authority of OCIO.

Question 40: How does the Government intend to evaluate solutions that rely on multiple FedRAMP-authorized Azure services composed into a single analytics capability?

Response 40: Solutions composed of multiple FedRAMP authorized services may be evaluated provided the vendor demonstrates a clearly defined authorization boundary, documented control inheritance, and centralized security governance.

OCIO will assess the aggregated risk of the composed architecture, including inter-service dependencies, data flows, identity and access management, logging, and monitoring. Vendors must show how the composed solution can be authorized, monitored, and sustained under a single RMF framework.

Question 41: Is the Government seeking specific transition artifacts (e.g., documentation, model handover, reproducible pipelines) to ensure portability at contract completion?

Response 41: Yes. To ensure portability and continuity, the Government anticipates requiring the following transition artifacts at contract completion:

Data Verification and Validation Link Analysis Software Platform – Artificial Intelligence (AI) Solutions for Network

14 | P a g e

- Reproducible data pipelines (ETL/ELT) with code/configuration, version history, and data lineage

- Model cards & documentation for AI/LLM/ML assets (training data sources, hyperparameters, evaluation/benchmarks, drift monitoring)

- Dashboards/visualizations with exportable definitions and dependencies

- Datasets/metadata/audit logs and access control (RBAC/IAM) mappings

- Platform configuration (infrastructure templates, APIs/SDKs, schema definitions)

- Operational runbooks (ConMon, incident response, change management)

Per PWS §3.8 (Data Rights and Ownership), all data ingested/processed/generated is Government property; contractors must provide unrestricted access and support export in common formats upon request or contract end.

Question 42: Does the Government anticipate that this RFI will inform a single-award or multiple-award acquisition strategy, should a solicitation be released?

Response 42: Reference Responses #1 and #24.

Question 43: Is the Government particularly interested in responses that include small business participation, value-added reseller models, or teaming approaches to deliver these capabilities?

Response 43: Reference RFI Response Instructions. At this time, the Government is seeking all potential sources capable of fulfilling the requirements provided within the Draft PWS.

Question 44: Beyond the stated requirements, what are the top 3-5 strategic outcomes FirstNet Authority aims to achieve with this platform (e.g., influencing policy, improving first responder safety, optimizing network investment by a certain percentage)?

Response 44: The Government seeks outcomes that advance data‑driven oversight of the NPSBN and mission effectiveness for public safety, including:

- Transparent, auditable verification & validation of contractor deliverables—measurable accuracy, automated data quality scoring, and audit trails to support Inspector General/audit compliance.

- Predictive insights & risk mitigation—forecast network performance, identify impairments/capacity constraints, and prioritize investments using AI/ML (including LLM‑assisted analytics).

- Benchmarking against commercial carriers—evidence‑based performance comparisons to strengthen accountability and optimize outcomes.

- Scalable, secure analytics platform—FedRAMP Moderate compliance, RMF/ATO alignment, and robust privacy/security controls.

- Usability & decision support—intuitive dashboards for technical/non‑technical users, executive‑level analytics, and natural language querying to improve speed‑to‑insight.

Data Verification and Validation Link Analysis Software Platform – Artificial Intelligence (AI) Solutions for Network

15 | P a g e

Question 45: How does this platform fit into the broader FirstNet Authority enterprise data and analytics ecosystem? Are there plans for integration with other key systems not mentioned in the

PWS?

Response 45: The platform is expected to fit within the broader FirstNet Authority data and analytics ecosystem. The Government currently operates an Azure database with Palantir Foundry and anticipates interoperability and reuse/migration of Government‑owned assets. Any additional enterprise integrations will be identified and prioritized through the Use Case Delivery Plan and agile ceremonies during performance.

Question 46: The PWS mentions supporting "executive-level decision-making." Could you provide examples of the key decisions executives are currently unable to make, or make with low confidence, that this platform is expected to support?

Response 46: The platform should help executives make high‑confidence, evidence‑based decisions such as:

- Oversight and compliance determinations tied to contractor obligations and IG/audit findings (via automated validation, audit trails, and conformance reporting).

- Investment prioritization for coverage/capacity enhancements informed by predictive modeling and risk scoring.

- Service‑level comparisons against commercial networks to guide policy and performance objectives.

- Incident and resilience planning using geospatial analytics and scenario modeling.

These outcomes align with PWS objectives for data verification/validation, predictive insights, benchmarking, and executive‑level analytics.

Question 47: What is the long-term vision for this platform's evolution over the 5-year period of performance? Are there anticipated future capabilities or data sources (e.g., IoT, video analytics) not listed in the current PWS?

Response 47: Throughout the Period of Performance of any subsequent requirement, the Government envisions:

- Scaling analytics volume from ~5 TB to ~150 TB (TBR) with concurrency and performance SLAs intact.

- Expanded AI/ML and LLM use for natural language querying, semantic search, automated summarization, and generative analytics integrated with secure RBAC and audit logging.

- Broader data sources (e.g., enhanced geospatial, crowdsourced, and carrier cybersecurity feeds) and continued historical analytics (2017–present).

- Stronger portability/data rights with reproducible pipelines, metadata, and model documentation to simplify future transitions.

Data Verification and Validation Link Analysis Software Platform – Artificial Intelligence (AI) Solutions for Network

16 | P a g e

- Future capabilities will be refined through agile sprints, UATs, and ConMon improvements.

Question 48: Could you provide more detail on the "carrier-provided network and cybersecurity data"? Specifically, what are the formats (e.g., APIs, flat files), velocity (e.g., real-time streams, hourly batches), and current volumes for these data feeds?

Response 48 : The PWS anticipates ingesting structured and unstructured carrier network and cybersecurity data alongside FCC BDC, GIS layers, and crowdsourced performance data.

Formats may include APIs, flat files/CSV, and database extracts; velocities range from real-time streams to batch feeds. Initial data is expected near ~5 TB, scaling to ~150 TB (TBR), with spatial granularity down to census block/geohash. Specific format/velocity details will be finalized in a subsequent solicitation and Use Case Delivery Plans. Respondents should propose a tiered pricing approach aligned with anticipated growth milestones (e.g., variable increments) to ensure cost predictability and scalability. Pricing tiers should include storage, compute, and performance SLAs, with options for on-demand expansion.

Question 49: The data volume is projected to scale from 5TB to 150TB. What is the anticipated timeline for this growth, and what are the primary drivers (e.g., new data sources, increased granularity)?

Response 49: The PWS sets initial volumetrics (~5 TB) scaling to ~150 TB (TBR) without prescribing a fixed timeline; growth will be driven by new data sources, increased temporal/spatial granularity, expanded KPIs, and historical backfill. Respondents should propose scalable storage/compute architectures and pre‑priced scalability options/CLINs to accommodate growth as mission needs evolve. See Response #s 38 & 48.

Question 50: Section 3.3 mentions incorporating Large Language Models (LLMs). Can you provide a few high-priority use cases you envision for natural language querying or generative analytics?

Response 50: High‑priority LLM use cases include:

- Natural language querying of network performance and compliance data.

- Semantic search across reports, dashboards, and audit artifacts.

- Automated summarization of network performance trends and executive briefs.

- Generative analytics assistance to craft what‑if scenarios and narrative insights for decision makers.

LLMs must be secured within the platform, aligned to RBAC, and documented for Change Management and ATO reviews.

Question 51: Section 3.6 mentions a "seamless transition" from an incumbent provider. Could you identify the incumbent and provide an overview of the current technology stack (e.g., platforms, languages, databases)?

Data Verification and Validation Link Analysis Software Platform – Artificial Intelligence (AI) Solutions for Network

17 | P a g e

Response 51: Reference Response # 3. The Government currently operates an Azure database with Palantir Foundry leveraging Government‑owned integrations, workflows, and user‑facing applications. A more granular stack overview (e.g., services, languages, databases) will be provided, as appropriate, in any future solicitation or transition artifacts. Reference questions 13 and 14 above).

Question 52: Could you provide more detail on the existing "AI/LLM/ML models and dashboards?" Specifically, their number, complexity, performance, and documentation quality.

Response 52: The exact numbers and performance metrics are under assessment. Per the PWS, the incoming contractor shall validate and migrate existing AI/LLM/ML models and dashboards, and provide model documentation (benchmarks, validation results) and audit logs as part of Use Case acceptance. Details will be enumerated in any future solicitation and transition‑in package.

Question 53: What are the most significant pain points with the current solution that this new platform must address? Conversely, what aspects of the current solution work well and should be retained or enhanced?

Response 53: The primary drivers for FirstNet Authority to continuously mature and optimize its network performance analytics and data validation capabilities is to avoid pain points called out in the PWS background, which include:

- Manual SME review, limited standardization of validation criteria, and lack of automated tools for V&V.

- Distributed data across platforms (secure file transfer, SharePoint, OneDrive, email) with inconsistent formats.

- Desired strengths to retain/enhance include:

o Existing Government‑owned data integrations/workflows/dashboards, Azure interoperability, and FedRAMP‑aligned controls—to be reused or replicated with minimal disruption.

Question 54: Could the government provide additional information on the user roles, responsibilities, and number of users by role?

Response 54: The platform must onboard ~75 active users, support role‑based access control (RBAC), and maintain audit logging. Specific role definitions and user counts by role (e.g., Analysts, Data Engineers, Product Owners, Executives) will be finalized during onboarding, documented in Use Case Delivery Plans, and enforced via RBAC/IAM configurations.

Question 55: Could the government provide additional details on the data sources, size, source location, and frequency of data refresh?

Response 55: Data sources include carrier‑provided network/cybersecurity datasets, crowdsourced performance data, FCC Form 477/BDC, and GIS/geospatial layers. Sizes range

Data Verification and Validation Link Analysis Software Platform – Artificial Intelligence (AI) Solutions for Network

18 | P a g e from initial ~5 TB to ~150 TB (TBR). Source locations may span cloud repositories, secure transfers, APIs, and enterprise data warehouses. Refresh frequency will vary by source (real‑time streams vs. batch intervals) and will be defined per use case during implementation.

Question 56: What kind of transformations to the raw data are being performed? Example:

Simple basic selects and filters, moderate aggregators and joins, or complex large multi-key joins

Response 56: Transformations will cover a spectrum—from basic selects/filters and moderate aggregation/joins to complex, large multi‑key joins, geospatial indexing (H3/geohash), and AI/ML‑driven cleansing, anomaly detection, and validation. The platform must provide ETL/ELT pipelines, data quality scoring, and audit trails.

Note: The platform currently utilizes ArcGIS licensing, which will be provided by the government. It is important to note that the use of ArcGIS is subject to change based on future requirements.

Question 57: Can the government provide clarity on the AI models being used today, specifically what and how many models?

Response 57: The specific model inventory and counts will be addressed in transition artifacts upon award of any subsequent solicitation. The PWS requires the incoming contractor to validate/migrate existing AI/LLM/ML models, ensure version control, provide documentation of changes/benchmarks, and support Government review/approval for material changes prior to deployment.

Question 58: What is the approximate scale of data being processed (volume, velocity)?

Response 58: The platform must support historical analytics (2017–present) with initial ~5 TB, scaling to ~150 TB (TBR), and handle real‑time and batch ingestion/processing. Velocity will vary by source—from streaming telemetry to scheduled batch updates—with performance SLAs (e.g., 2‑second average response for interactive queries under normal load) and concurrency (≥ 75 users) maintained. See Response #s 38 & 48.

Question 59: What specific AI/ML models are currently in production?

Response 59: Specific models in production will be…