Answers to EMWN RFI questions v1.pdf

27 May 2026

The Government would like to thank all the organizations that submitted questions.

The table below is an extract of each vendor question, and the associated response immediately to the right.

Industry Question Government Response Could you please let me know if this is a new requirement or a follow-on to an existing contract? If it is a follow-on, I would appreciate it if you could provide the contractor's name and the contract number.

This is not a new requirement, and this is not a follow-on to an existing contract. It is a request to industry asking for industry to provide this assessment of what the cost might be to implement and operate a single DoW wide Emergency Mass Warning and Notification system.

We noticed a discrepancy between the posting on SAM.gov, which lists the due date as 5/25, and the Sources Sought document itself, which indicates a due date of 5/29.

The closing is 5/29.

1. The RFI states that questions are due by 4:00 PM Eastern Time on May 8, 2028, while responses are due May 29, 2026. Please confirm the correct questions deadline.

Questions are due 8 May 2026.

2. Does the Government prefer one prime contractor responsible for the full EMWN solution, or may vendors propose a team consisting of a COTS solution provider, reseller, cloud provider, and implementation/support partner?

The government does not have a preference at this time and the vendor may use a team in their development of their response.

3. Is the Government expecting the COTS EMWN application itself to already have a FedRAMP IL5 authorization, or is deployment within a FedRAMP-approved IL5 cloud environment with a contractor-prepared ATO package acceptable?

The applications should be able to demonstrate the ability to get an ATO and an IL5 environment certification.

4. Will the Government provide existing EMWN data schemas, DMDC interface requirements, identity/ICAM requirements, and NIPRnet integration details during a future solicitation phase?

The Government will not provide these data for this RFI.

5. For ROM purposes, should respondents assume the 4,000,000 primary subscribers are active users throughout the full five-year period, or should a phased user migration/adoption curve be assumed?

The development of a vendor estimated costs or phase in (or not) should be reflected in the vendors estimate and state why that approach was chosen.

6. Should secondary subscribers be included in SMS and voice volume estimates beyond the provided planning figures, or should vendors use the monthly usage averages provided in Tables 1 and 2 as the controlling ROM basis?

The RFI clearly outlines how secondary subscribers should be planned. How they are factored into a vendor’s solution is up to the vendor.

7. Should vendors include optional onsite training travel costs in the ROM estimate, or exclude travel based on the RFI statement that onsite training travel will be separately reimbursed by subscriber agencies?

The vendor may include the optional costs separately in their ROM and explain why they have chosen their approach.

8. Does the Government require the EMWN solution to integrate with existing Giant Voice / Indoor Voice systems only through APIs, or should respondents also estimate interface configuration and testing support?

The vendors solution will need to communicate with existing Giant/Indoor systems. This should be accomplished to DoW/Army standards for cyber security.

9. Does the Government have a preferred Common Alerting Protocol version, or should respondents assume the most recent CAP version available at the time of proposal?

The Government has no preference currently but suggests the most recent CAP version as reasonable.

10. For the workstation agent, should respondents assume Windows only, or must Mac/Linux endpoint support be included in the ROM estimate?

The Government is traditionally a windows environment. For estimation purposes this may be assumed.

11. Should the 24/7/365 help desk be dedicated exclusively to EMWN, or may vendors propose a shared support desk model with defined SLAs?

The vendor may suggest either but should describe how and why their approach is used in their solution.

12. Are ROM cost estimates expected to include transition-out services across FY32, or should transition-out be shown as a separately identified optional cost element?

The Government has provided a place for these costs if the vendor can include them.

This section refers to a government provided e-mail server. Please provide more information about this server. Is this an Army hosted server, a DISA hosted server, or an Office 365 Solution? What email protocol would be required?

The vendor’s approach should provide an economical solution. If the vendor can identify a significant cost variation among these, that should be noted in their solution it should be identified.

This section refers to supporting DoW zero trust capabilities. Please provide information about the specific zero trust technologies in use by DoW.

The vendor should use their knowledge on zero trust and explain their concerns, if any, in their submission.

This section refers to meeting DoW policies. Please provide a listing of applicable DoW policies.

Vendors are encouraged to research the DoD’s instructions and directives as needed to assist in the development of their submission.

This section refers to compliance with DoW ICAM capabilities. Will the government provide a unified DoD ICAM authentication system or will this involve accessing individual DoW component ICAM authentication systems?

The vendor shall explain how they would use one or the other approach and the cost difference if it significantly alters the submitted cost model.

We assume the current deployed solution in the DISA DECC is an IL5 solution, please confirm.

The DoW today runs many EMWN solutions at various IL levels. The Army’s solution is operated in an IL5 environment.

With which GV OEMs does the EMWNS need to integrate?

The DoW has many GV vendor devices and there is not a common or centralized repository of this equipment. Generally, some are older devices and others up-to-date or recent.

Clarify what interface should be used when the GV OEMS will not support pure software-based API connectivity?

The vendor’s cost model needs to account for this uncertainty.

How many Giant Voice and Indoor Voice systems across DOW will EMWNS be required to integrate with?

A specific number is not available at this time.

Does the requirement to integrate via API apply only to indoor voice?

This is up to the vendor and the type of devices in the field.

The requirement states a maximum number of secondary subscribers at 12 per user, creating a delta between primary users at 4 million and a maximum of 48 million secondary subscribers for a potential total of 52 million users. This significant delta will impact cost. Please provide more information about the number of additional users and the application of alerting to those additional users.

How industry will accommodate this perceived variance must be described in the vendor’s submission.

Section 5 of instructions notes, cover page, table of contents, statement of work gaps -will not be included in the 15-page limit, no reference to table of contents or statement of work gaps in this submission section - Please clarify. Also does Past performance count toward 15 page limit?

The instruction is complete as stated in the

RFI.

“Previous experience” is part of the 15 page limit if the vendor decides to include it.

There are multiple instances of a requirement for 100 attributes for a user.

For example, 100 total home addresses, can you please clarify?

The instruction is complete as stated in the

RFI.

What is the required Security Clearance level for personnel?

For estimation purposes unclassified.

Please clarify what is meant by repair materials.

If the vendor's submission or estimate contains equipment or custom software, the Government would need to repair the equipment or software with proper repair materials if the vendor departed.

Clarify NARA/records schedule expectations for EMWN log and receipt data and PII in reporting exports (retention

vs. 2-year language in SOW if applicable).

EMWN will have to provide reports to NARA. So the operation of the EMWN system must account for this effort in some fashion.

Does the Government expect vendors to hold a standalone ATO for the EMWN solution, or will this capability inherit authorization under an existing DoW or enterprise ATO?

This will be a totally new ATO as this is a major change. The Government anticipates the re-use of an existing Privacy Act SORN.

For Section 5.1 – Independent Testing, is the independent testing specialist expected to be procured and funded by the DoW or by the selected vendor?

The vendor may include this requirement in their submission or explain how the work will be accomplished in their submission.

Is the CAC / ICAM federation pattern LDAP, SAML, OAuth/OIDC, or other?

SAML

Will DoW provide NIPRnet connectivity to the vendor's cloud environment, or must the vendor independently establish NIPRnet peering (e.g., via a DISA cloud access point)?

The vendor should include all costs that they estimate to provide a workable solution.

Is there an approved cloud service offering (CSO) already on contract that could serve as the IL5 hosting environment, or should the vendor provide their own dedicated hosting?

The Government does not have an approved CSO at this time for this effort.

Depending on the vendor’s estimated solution all associated costs should be accounted for in their estimate.

Section 6 prohibits the core application from collecting or retaining any location data. Does this prohibition extend to anonymized telemetry and aggregate location analytics, or only to individual-level subscriber location data?

The prohibition applies to both.

Does the prohibition apply to temporary, in-memory location data used solely for real-time geofencing decisions that is never written to persistent storage?

Location data shall not be collected. It may be used to define areas that are geofenced.

Are dependents stored in DMDC, or do they exist only within the EMWN system after a CACholder completes sponsorship?

For estimation purposes they will exist within EMWN.

Is there an approved mobile device management (MDM) solution (e.g., Intune GCC High) that the mobile app must integrate with for distribution and policy enforcement?

There is not an approved MDM solution at this time.

What existing Giant Voice and Indoor Voice systems are deployed across DoW installations, and what CAP version or API dialect do they use?

There are both older and newer GV/IV devices in the DoW inventory by multiple vendors.

Use of the most recent CAP version may be used for estimation purposes.

Does DoW require all cloud services to be hosted in Azure Government specifically, or are other IL5-authorized environments (DISA MilCloud 2.0, AWS GovCloud) acceptable?

No requirement. The vendor should sufficiently explain how their solution will be hosted.

Are non-Windows endpoints required for the Desktop Notifier Client (macOS, Linux

The Government is traditionally a Windows environment. For estimation purposes this may be assumed.

desktop, ARM64 Windows)? If yes, approximate count and installations.

How should dependents authenticate (since they do not hold CAC) — email/SMS one-time token plus password, DEERS Family ID, USID with PIN, receive-only with no login, or other?

Dependents will receive notifications or warnings but will not otherwise interact with the system. Their primary subscriber will provide all secondary subscriber data.

Please confirm the RFI dues Date. Sam.gov indicates 5/25 and RFI document indicates 5/29. Which is correct?

Due 5/29

Is VDI / smart-card passthrough for the desktop agent required?

yes

What is the expected timeline for the RFP be released?

There is no RFP at this time. This is not an acquisition.

What is the expected Contract award timeframe? There is no award planned at this time

Shall the contractor provide Security Operations Center (SOC) monitoring service and reporting?

This would be dependent on the vendor’s choice of solution and its implementation.

Shall the contractor provide personnel knowldgeable of external systems such as Giant Voice, Inside Voice, Unified Facility Code (UFC) 4-021-01 inbuilding paging, and other interfaces to ensure integration and operational capability over these communicatioin modalities?

This would be dependent on the vendor’s solution.

Shall the EMWN provide Integrated Public Alert & Warning System (IPAWS) alerts?

Yes, the solution must be able to communicate with IPAWS.

Shall the EMWN receive weather alerts and automatically generate warnings?

There is no requirement automatically to generate weather warnings.

Is the government lookin for Commercially Owned Commercially Operated (COCO) or Government Owned Contractor Operated

(GOCO)?

The Government is asking for industry to provide a recommendation with a rationale on the platforms to be used in their submission.

The deadlines for submission listed on the RFI documentation and on Sam.gov are different. Is the deadline May 25 (on Sam.gov) or May 29 (documentation)?

The submission is due on 5/29

Will contact information for the primary subscribers be stored in the mass notification system?

Yes

Will contact information for the secondary subscribers be stored in the mass notification system?

Yes

What is the estimated number of desktops that will have the desktop alerting agent installed?

While a specific number of desktops has not been identified, vendors can safely assume the 4M primary subscribers will have Windows based systems.

What identity credential providers are currently approved (ref. SOW 9.2.1.87)?

The DoW uses CAC based authentication.

The Sam.gov Posting indicates the RFI response is due May 25, 2026 at 5PM EDT while the RFI document page 6, Section 8, indicates May 29, 2026 at 4pm ET. Since May 25th is a Federal Holiday, please confirm that in fact the RFI is due on May 29, 2026 at 4pm ET.

Due 5/29.

Currently the NAICs listed is 642230- Emergency and Other Relief Services. This NAICs is intended for the purposes of human relief services such as deliver direct humanitarian and emergency response services, particularly during or after crises.

It focuses on relief operations and recovery support, not technology. We recommend more appropriate NAICs such as 541519 - Other Computer Relations Services (note 18 allows SB under 150) which provides for products/licenses as well as IT Value Added Services including implementation services, systems integration, helpdesk, training , and support with a %of services between 15-50% of total procurement, or 518210- Data Processing, Hosting, and Related Services which provides for SaaS solutions inclusive of proper services to support the Hosted application.

A more appropriate NAICS code will be applied.

We assume the current deployed solution in the DISA DECC is an IL5 solution, please confirm.

The DoW today runs many EMWN solutions at various IL levels. The Army’s solution is run in an IL5 environment.

With which GV OEMs does the EMWNS need to integrate?

The DoW has many vendors and not all their systems or subsystems are known or have been reported. Generally, DoW systems and devices vary from older devices to more up-to-date or recent.

Clarify what interface should be used when the GV OEMS will not support pure software-based API connectivity?

The vendor’s cost model needs to account for this uncertainty.

How many Giant Voice and Indoor Voice systems across DOW will EMWNS be required to integrate with?

A specific number is not available at this time.

Does the requirement to integrate via API apply only to indoor voice?

This is up to the vendor and the type of devices in the field.

The requirement states a maximum number of secondary subscribers at 12 per user, creating a delta between primary users at 4 million, and a maximum of 48 million secondary subscribers for a potential total of 52 million users. This significant delta will impact cost. Please provide more information about the number of additional users, and the application of alerting to those additional users.

How industry will accommodate this perceived variation must be described in the vendor’s submission.

Section 5 of instructions notes, cover page, table of contents, statement of work gaps -will not be included in the 15-page limit, no reference to table of contents or statement of work gaps in this submission section - Please clarify. Also does Past performance count toward 15 page limit?

The instruction is complete as stated.

No past performance has been requested.

There are multiple instances of a requirement for 100 attributes for a user.

For example, 100 total home addresses, can you please clarify?

The instruction is complete as stated.

What is the required Security Clearance level for personnel?

For estimation purposes unclassified.

Please clarify what is meant by repair materials.

If the vendor’s solution contains equipment or custom software, these are the materials the Government would need to repair the equipment or software if the vendor departed in an unplanned manner.

Clarify NARA/records schedule expectations for EMWN log and receipt data and PII in reporting exports (retention

vs. 2-year language in SOW if applicable).

The vendor will have to support the submission of EMWN data and/or report to the Government any information necessary for submission to NARA.

Clarify acceptable geographic/attribute-based targeting (DMDC address only, The pg 5, section 6, (g) provides guidance on how a vendor solution would use installation GIS, KML limits) and approval for optional location-aware mobile use.

Reference 9.2.1.25-28; 9.2.1.45 of SOW location information in an acceptable manor. If a vendor intends to use another method the vendor may want to disclose their process.

What should the Transition-In 90 day period include? Does the 90 day transition in period include time for achieving ATO and migration of all services?

It should contain all the cost and functions the vendor believes in needed to transition in.

For security reasons, we assume that any desktop application must be native, with no reliance on a third-party vendor. Please confirm, true or false?

This is for the vendor to determine. The Government is looking to industry to provide the best practice. If a third party vendor is or is not a best practice it should be described and costed appropriately.

RFI Section 9 lists the question submission deadline as "4:00 PM Eastern Time on 8 MAY 2028." Given the RFI response submission deadline of 29 May 2026, we read this as a typographical reference to 8 May 2026. Could the Government confirm the intended question deadline date?

Your interpretation is correct.; read as “8 May 2026”.

Statement of Work paragraphs 6.1, 8.3.4, and 9.1.1 each cite DoD Instruction

6055.17 (DoD Emergency Management Program). Could the Government confirm that DoDI 6055.17 — and specifically the mass warning and notification performance requirements stated in paragraph 5.5 — is the controlling technical standard against which respondents' proposed solutions will be evaluated for compliance?

The Government has provided multiple references for the vendor to use in development of their solutions. They should all be consulted appropriately.

Due Date: There are conflicting dates between the SAM.gov posting and the RFI document. Please clarify the RFI response due date. Is it May 25 at 5 PM ET or May 29 at 4 PM ET?

Due date 5/29

Section 3 Objective states Through this RFI, the Army seeks to: Provide industry an overview of the Army’s current baseline EMWN capabilities and performance requirements. Are all the requirements within the SOW met today by the existing Army ALERT! Solution? If not can the

Currently all the requirements in this document are met by the ALERT! system.

All other information is in the RFI.

government detail what capabilities included within this RFI would be new capabilities not currently met by the existing ALERT! Solution? Which are met by the other EMWN solutions utilized across the DOW?

SOW Section 5 Scope, 5.1 FedRAMP and Impact Level 5: This section states the proposed COTS system must be hosted in a FedRAMP approved commercial cloud environment at DoW Impact Level 5 with contractor prepared Authority to Operate (ATO) package. Please clarify what this means for contractors proposing a Software as a Service (SaaS) Cloud Service Offering (CSO) which includes the application, platform and infrastructure?

If a vendor solution cannot meet IL5 criteria it will be deemed non-responsive.

Vendors should estimate the cost of their developed solution that operates in an IL5 environment.

SOW Sections 5.1 Scope; 6.1 Performance Standards; 8.1 System Administration: Can the Government clarify whether a phased or incremental authorization approach will be considered to enable initial operational capability post contract award?

Vendor solutions must meet all criteria on day 1; no incremental approach would be acceptable.

SOW Section 5 Scope, 5.1 FedRAMP and Impact Level 5: At the time of award, does the contractor need to only demonstrate the cloud infrastructure is IL5 accredited or that the entire COTS solution is IL5 accredited?

The vendor’s entire solution must operate in a properly accredited IL5 environment.

(Section 5. Requested Information and Response Format) Please confirm that the technical description Enclosure 2 as mentioned in point a) will not be part of 15-page limit, as the general instructions states that “A complete response shall not exceed 15 pages (excluding a cover letter, the cost estimate worksheet in Enclosure 1 and the statement of work in Enclosure 2.”

Enclosure 2 is the Government Statement of work and should not be reiterated. If a vendor must quote any part of Enclosure 2 it will be counted as part of the vendors 15 page response. You may incorporate any relevant RFI portions by reference.

General Instructions, Requested Information and Response Format: Will the government expand the page limit to 25 pages?

Not at this time

SOW Sections 5.0 Scope; 9.2.1 Functional Aspects; 6.2 Program Management: How does the Government envision the enterprise governance and organizational model for EMWN, specifically regarding centralized versus federated administration across Commands and installations, and should vendors propose a recommended hierarchy and role-based access control structure to support enterprise-wide visibility and delegated execution?

Enterprise Governance is still under consideration. Vernor’s should not propose a recommended hierarchy.

SOW Sections 5.4 System Requirements Overview; 9.2.2 Content; 9.2.3 Registration: What are the Government’s expectations for data synchronization frequency, latency, and reconciliation of conflicting or incomplete records across systems?

The vendor must address relevant details from available DoDI’s or DoDD’s to accomplish meeting the government requirements.

SOW Sections 6.1 Performance Standards;

9.1 Tool Capacity; 9.2.1.61 Reporting and

Tracking: Can the Government define required performance thresholds for alert delivery, including expected timelines for reaching a percentage of targeted users, acceptable latency across delivery channels, and any surge or enterprise-wide alert scenarios the system must support at full scale?

The specifications desired are contained in DoDI’s and DoDD’s noted.

SOW Sections 9.2.1.24–9.2.1.27 Mobile Application Requirements: Can the Government clarify acceptable approaches for location-based alerting, including whether temporary or event-based location usage or anonymized/aggregated location data may be used to enhance targeting effectiveness while remaining compliant with stated privacy constraints?

The privacy limitations are clear. The solution may not anonymize or collect location data of users. For an alert to cover a specific location(s), location data must be generated and sent to subscriber devices but no associated user information may be stored or collected.

SOW Sections 4.0 Period of Performance;

5.0 Scope; 8.1 System Administration; RFI

Section 5 Requested Information: Which existing legacy systems are expected to be replaced or integrated, and what are the

These issues should be explained in a vendor’s response. The Government is reaching out to gain an industry approach to overcoming this issue. What does industry believe exists or is achievable?

Government’s expectations for data migration scope, validation, coexistence/parallel operations, and final cutover strategy?

SOW Section 6.10 Training; Section 10 Training: Does the Government require role-based training programs with defined proficiency or certification standards, and what are the expectations for training frequency (especially on site), delivery methods, and measurement of user readiness across a global user base?

In this section, the Government seeks the vendors recommendation decision to the Government on industry best practices in this paragraph.

SOW Section 7 Cost Estimate Definitions;

RFI Section 6 Program Data for Cost Estimating: Will the Government consider alternative pricing models beyond per-subscriber constructs, such as enterprise licensing or usage-based tiers, particularly to account for variable messaging volumes and surge scenarios?

Yes, these will be considered. The Government is interested in the bottom-line cost of a vendor’s solution; and an explanation of why it was chosen and why it makes sense for the Government.

SOW section 9 Tool, Tool Capabilities, Functional Aspects, CAC Holders: Is the intent that recipients are registering themselves and their dependents in the EMWN system directly or when they register in a system such as DMDC ID Card Office Online, their information is synced directly to the EMWN system? Will the government consider an approach where that registration is managed entirely through the existing ID Card Office online or similar system for CAC Card holders and those they sponsor?

Yes, this will be considered. It is anticipated that Primary members will register their secondary members.

Secondary members are not likely to have CAC cards for access.

If all the data can be captured by the existing ID Card Office online, that process should be explained.

Does the DOW expect to integrate visitor management and base access control systems such as AIE or DBIDs into the EMWN system for more precise location awareness data for a recipient as they enter an installation?

Bearing in mind privacy restrictions, the Government would like industry to propose this functionality and describe the incremental cost associated if any.

Does the government plan on including Temporary Duty Assignment location data as a part of the authoritative data source and is this data contained in the DMDC

The Army cannot dictate the scope of this implied change to DMDC. The temporary location and time period or duration shall be managed by the vendors solution.

database for the purposes of more precise alerting?

SOW Section 9 9.3 Warning/Notification External Modality Interfaces: Can the government clarify if the contractor will be expected to connect the EMWN system to the giant voice systems under the scope of this contract or only provide a capable interface?

The vendor shall understand the interface and assist remote personnel in connecting EMWN to their external modality.

RFI Section 6. EWMN Program Data for Cost Estimating Purposes: This states that the solutions core application hosted external to the mobile applications may not collect or retain any location information on where a subscriber is or has been.

Should this be interpreted to mean that the core EMWN database cannot capture the “last known” location from a mobile user even if on a temporary basis?

Correct. The EMWN database may not collect, receive, hold or anonymize a subscriber’s location.

SOW section 9 Tool, Tool Capabilities, Functional Aspects Desktop Client: This states “The system shall support desktop client check-in as often as every 3 minutes across the enterprise.” Can the government clarify if this means that the desktop client is polling the EWMN core application server for messages or if check in is interpreted to mean that it is providing a status of the client back to the server every 3 minutes?

The time of 3 minutes is a recommended maximum. A vendor solution that uses polling or status of the client would be a vendor solution-specific decision.

SOW section 9 Tool, Tool Capabilities, Functional Aspects, Desktop Client: Is the desktop client expected to report location data via manual check in/ accountability or provide SOS/ duress functionality? If so how is location data expected to be reported and shared with the core EMWN application? Is the desktop location expected to become the “last known” location for more accurate alerting compared to using a static location such as assigned duty station location or a temporary duty station location?

As the core system will not collect, hold or anonymize a subscriber’s location, it shall also not collect, report, pr anonymize a desktop location.

SOW section 9 Tool, Tool Capabilities, Functional Aspects: This states the System Administrator shall be able to add custom attributes to the custom attribute field in a drop down list and be defined as public or private. Can the government define what it means by public or private and provide examples for each?

These are general purpose attributes that can be custom configured to capture future needs or methods of categorizing information.

SOW section 9 Tool, Tool Capabilities, Content: Please clarify if “(Up to 100 per recipient)” refers to the number of characters per attribute field.

The “up to 100 per recipient” is a process a subscriber may use to capture additional information about them.