H92421-26-QE036 - CDAO Responses to Q-A.docx

H92421-26-E036 Skills Assessment Platform Government Responses to Q&A

A: (a) The platform is not expected to store, process, or transmit CUI or Covered Defense Information. The system will handle anonymized assessment data. Should an offeror’s platform choose to process PII, the contractor is fully responsible for its protection. (b) No. As stated in previous responses, no specific CMMC level, minimum SPRS score, or hosting authorization (e.g., FedRAMP, DoD Impact Level) is required for award.(c) Yes. CONUS-only hosting is required.

A: The platform is expected to operate as the vendor's standard commercial SaaS solution. A Government-hosted, GovCloud, or on-premise deployment is not required. No ATO is required at this time

A: (a) Detailed API documentation and technical specifications for Digital University will be provided to the awardee post-award. The platform must support REST APIs, SSO (SAML/OIDC), and LTI.(b) This information will be provided post-award. (c) A phased integration is anticipated. Per the PWS, tenant access is due in five days (D001), followed by the Skill Circuit Calibration Plan in 15 days (D003). System integration will proceed concurrently during this onboarding phase.

A: The platform is expected to operate as the vendor's standard commercial SaaS solution. A Government-hosted, GovCloud, or on-premise deployment is not required. No ATO is required at this time.

A: Vendors should quote a per-license unit price for 500 licenses and an extended total amount for CLIN 0001

A: CLIN 0002 is for the warranty to cover the 500 licenses. If a license need to be transferred to a new user, the warranty will need to cover remaining period of CLIN 0001 as mentioned in Task 7

A: Licenses may be reassigned. Per a previous response, the Government's ideal state is for licenses to be re-assignable after a period of inactivity (e.g., 60-90 days). Offerors should propose their standard commercial license reassignment policy.

A: The platform must have the capacity for all 500 licenses from the start of the Period of Performance. However, end-user onboarding will be rolled out in a phased manner throughout the contract period.

A: Quotes should be held firm for 30 days

A: The platform must have the capacity for all 500 licenses from the start of the Period of Performance. However, end-user onboarding will be rolled out in a phased manner throughout the contract period.

A: Yes, Government SMEs will be made available during the initial 15-business-day period for the Skill Circuit Calibration Plan (D003). Calibration is primarily an onboarding event, but the Government reserves the right to revisit calibration as mission needs evolve.

A: Yes, commercial past performance references are acceptable. (b) No (c)

A: The five-page limit includes the entirety of the technical narrative, including any embedded tables or figures. Title pages and reference lists do not count against this limit. There are no specific font or margin requirements beyond general readability.

A: A completed ACR/VPAT is not required with the quote but must be provided upon request. The platform must be WCAG 2.1 AA compliant.

A: That is correct. Beyond the PWS limitations, there are no additional restrictions on the use of assessment results for internal Government talent management and skills analysis.

The PWS states that the Government requires an existing, commercially available, subscription-based SaaS solution. Would the Government consider a commercially available SaaS platform that includes configurable skill-assessment modules, provided the role-specific Skill Circuits are calibrated with Government SMEs after award?

A: Yes, but no custom software development: The Government welcomes highly configurable commercial SaaS platforms. However, the vendor must understand that "configuration" (setting up existing system features, rubrics, and mapping) is acceptable, but "custom coding/custom feature development" is not.

For Skill Circuit Customization, will the Government provide role-specific competency frameworks, question banks, rubrics, or learning objectives, or is the contractor expected to provide all initial assessment content?

A: The Contractor is responsible for bringing the baseline assessment content, question banks, and rubrics. The "customization" process post-award is a collaborative mapping exercise where the Government reviews the Contractor's content to ensure it fits DoW roles, not an exercise where the Government writes the tests.

Are hands-on coding labs required, or will scenario-based, knowledge-based, multiple-choice, rubric-based, and practical-response assessments satisfy the requirement?

A: To accurately measure technical proficiency in developer and engineering roles, the platform must include interactive, hands-on coding labs/assessments. Text-only or multiple-choice questions alone will not satisfy the core technical requirements.

Are raw data exports required, and if so, what preferred format should be supported: CSV, XLSX, JSON, PDF, API, or another format?

A: Exports required, API preferred

The solicitation references technical support and warranty requirements. Should the 48-hour warranty/support language be interpreted as applying to all technical defects, while the PWS support-ticket, AQLs apply by severity, or does one standard control?

A: The PWS support-ticket severity levels and their corresponding Acceptable Quality Levels (AQLs) serve as the primary, governing standard for all routine, daily technical support operations.

Technical incidents, system outages, and software bugs will be classified and prioritized under the tiered severity framework (e.g., Critical, High, Medium, Low) and must meet the specific response and resolution timelines outlined in the PWS performance metrics.

The general 48-hour technical support and warranty language represents the maximum allowable fallback window for the Contractor to acknowledge and begin actively correcting any major technical defects or system non-conformities that are not otherwise resolved within the standard operational AQL framework.

In the event of a conflict between the two clauses, the more stringent timeframes established in the PWS Support-Ticket AQL table will take precedence for operational incident management.

For subscription management, how should the Government define “unused,” “stale,” or reassigned licenses? Should offerors propose their own license-reassignment policy?

A: Yes

Are commercial past-performance references acceptable for the Relevant Experience factor if federal past performance is limited?

Does the five-page technical-description limit include security documentation, VPAT, commercial product literature, screenshots, or only the primary technical narrative?

Are AI-assisted assessment generation, analytics, or recommendation features acceptable if all final assessment content and recommendations are reviewable and controllable by authorized users?

A: Yes, but it must be explainable and ensure the results are not biased against any categories of people

Should offerors submit questions using the provided Questions and Answers document/template, or is submission by email acceptable?

For quarterly reporting, should reports include individual-level results, aggregated cohort-level skills gaps, role-level analytics, or all of the above?

A: All of the above

Is a VPAT / Accessibility Conformance Report required with the quote, or only after award? The PWS requires Section 508 compliance, and we want to make sure we submit the proper accessibility evidence.

A: A completed ACR/VPAT is not required with the quote but must be provided upon request. The platform must be WCAG 2.1 AA compliant.

What specific PII fields are authorized or prohibited for user provisioning and skills reporting?

A: The Government’s preferred integration method is for the Contractor’s platform to utilize anonymized user identifiers, which eliminates the need to process or store Personally Identifiable Information (PII).

Because Digital University (DU) manages user identities and can pass an anonymized unique identifier to the Contractor's platform for assessment tracking, the processing of PII is not required to satisfy the contract.

However, if an Offeror's commercial platform requires or chooses to utilize standard user PII fields (such as name, official .mil/.gov email address, rank, or unit) for user provisioning and skills reporting, the Contractor is permitted to do so provided they fully protect and safeguard all processed data in accordance with applicable federal and Department of War (DoW) privacy and security regulations (including DFARS 252.204-7012).

Under no circumstances is the Contractor authorized to process, store, or transmit high-risk PII/PHI (such as Social Security Numbers, personal financial information, or medical records).

For the listed Skill Circuits, should offerors provide full coverage for all listed roles at award, or is it acceptable to provide baseline circuits at award and complete calibration within the PWS timeline?

A: Platform Ready on Day One, Calibrated on Day Fifteen: The vendor's platform must have full, out-of-the-box coverage for the Skill Circuits at award. The 15-business-day window following the award is strictly for fine-tuning, mapping, and calibrating those existing baselines with Government SMEs, not for building the circuits from scratch.

For Task 4, “interoperable with Digital University (DU),” what integration method is required or preferred? For example: API integration, SSO, CSV export/import, deep links, SCORM, xAPI, LTI, or another specific method?

A: Modern Web Standards Required: The Government requires modern web integration capabilities. The contractor's platform must natively support REST APIs, Single Sign-On (SSO), and LTI (Learning Tools Interoperability) to ensure a seamless data exchange. Legacy or manual methods like batch CSV imports are not the preferred long-term solution.

Does the Government require automated course recommendations inside DU, or is it acceptable for the platform to generate course recommendations and links based on identified weak skill areas?

A: Internal Generation, External Connection: The Contractor's platform is responsible for identifying weak areas, cross-referencing them, and generating the course recommendations and deep links within its own user interface. The Contractor is not required to inject or write code directly inside the DU environment.

Is CAC/PIV authentication, SAML, OIDC, or another specific SSO method required at award, or may user accounts be provisioned through administrative onboarding for the base year?

A: Single Sign On or equivalent capability is required at award. Users will onboard throughout the contract period.

Does the Government require FedRAMP authorization, DoD Impact Level authorization, an agency ATO, GovRAMP/StateRAMP status, CMMC status, or a specific NIST/FIPS security posture at quote submission or prior to award?

A: No but PII must be protected appropriately if it is used at all.

If formal FedRAMP or DoD Impact Level authorization is not required at award, will the Government accept a SaaS solution hosted in AWS GovCloud or another authorized cloud environment with a documented security roadmap, incident-response process, encryption controls, and compliance matrix?

A: Yes, with protections in place for any PII that may be collected.

Will the platform process, store, or transmit CUI, CDI, or only limited user/account information and aggregated skills-assessment results?

A: Anonymized Data Flow: The Contractor's platform is not required or expected to process or store user PII. Digital University (DU) will handle all identity management and PII, passing only an anonymized user identifier to the Contractor's platform for assessment tracking.

Performance Work Statement (PWS): Enterprise Skills Assessment Platform:

- Can the Government identify what system DU refers to – i.e. provide a point of contact or technical documentation for it?

- What integration method is expected or available (REST API, LTI, SSO-based redirect, batch/CSV course-catalog export, or another mechanism)?

- Is a DU sandbox, API specification, or sample course taxonomy available to offerors prior to award, so this interoperability can be scoped and estimated accurately?

- Will the assessment system receive data when the DU courses are completed?

A: Digital University (DU) refers to the Department of the Air Force and Department of the Space Force’s centralized digital and cyber-training platform, which is hosted at https://digitalu.af.mil and managed by the BESPIN software factory. Because detailed technical documentation, network specifications, and direct engineering points of contact are controlled system artifacts, they will be provided exclusively to the awardee post-award during the initial system onboarding phase.

The Government expects the Contractor's platform to natively support standard, secure web integration protocols, specifically REST APIs, Single Sign-On (SSO) utilizing SAML 2.0 or OpenID Connect (OIDC), and LTI (Learning Tools Interoperability). The precise technical handshake, authentication method, and data exchange schemas will be finalized post-award during joint engineering sessions to ensure alignment with architectural baselines.

Due to strict DoD information assurance, cybersecurity controls, and procurement integrity constraints, a live DU sandbox, official API specifications, and active course taxonomies are not available to offerors prior to award. Offerors must demonstrate in their proposals that their platform possesses robust, commercially proven API capabilities and the inherent flexibility to ingest, cross-reference, and map external training catalogs.

The long-term integration architecture is intended to support bidirectional data exchanges. While the primary requirement is for the Contractor's platform to cross-reference identified weak skill areas and recommend corresponding DU courses, the post-award engineering design will look to incorporate mechanisms that allow the assessment system to securely receive and log course completion metrics.

- Is there an existing assessment tool, process, or question bank in current use for these or similar technical roles that the Government can share with offerors, even at a high level?

- Are there specific DoW job-role definitions or competency frameworks (beyond the seven Skill Circuits named in the PWS) that calibration should be built against?

· A: Any calibration plan (including the D003 deliverable) must align with the DoD Cyber Workforce Framework (DCWF).

· The DCWF provides a standard taxonomy of cyber work role. Each work role is defined by structured KSATs (Knowledge, Skills, Abilities, and Tasks).

· The DCWF explicitly maps onto the parent NICE Framework (NIST SP 800-181) and the United States Cyber Command Joint Cyberspace Training and Certification Standards (JCT&CS).

· Calibration methodologies should categorize technical competency assessments across the standardized DoDM 8140.03 Proficiency Levels: Basic, Intermediate, and Advanced

A: The assessment platform must be highly modular. Because DoW learners operate across varying network bands (IL4, IL5, and tactically degraded environments), text-based interfaces, coding test sandboxes, and low-bandwidth chat/quiz options are highly preferred over real-time video streaming or high-bandwidth video-processing solutions.

· Primary Expected Delivery: The standard and expected delivery modes consist of text-based interactive chat interfaces, structured quizzes (multiple-choice/single-choice), and direct coding test environments.

· Coding Tests: For technical and developer roles, the system is expected to deliver browser-based IDEs or containerized sandboxes to evaluate hands-on execution.

· Proctored exams may be out of the price point for this effort.

Will the Government provide the necessary API documentation, interface specifications, authentication requirements, or other technical integration guidance for Digital University? If these artifacts are unavailable prior to award, will interface development occur after award in collaboration with Government personnel?

The Government will provide the necessary API documentation, interface specifications, and authentication requirements post-award during the onboarding and system integration phase.

Due to cybersecurity and information assurance protocols, these technical artifacts and sandbox environments cannot be made available to offerors prior to award. Actual interface development, credentialing, and secure system mapping will occur post-award in close coordination with Government technical personnel and the Digital University program office.

Offerors must demonstrate in their proposals that their platform possesses the inherent capability to integrate via standard, secure API methods (e.g., REST, LTI) prior to award.

Will the Government provide competency models, proficiency levels, or evaluation criteria for each Skill Circuit, or is the contractor expected to provide commercially established assessment frameworks for Government review and approval?

A: The Contractor is expected to provide their commercially established assessment frameworks, technical rubrics, and evaluation criteria for the designated Skill Circuits as part of the Skill Circuit Calibration Plan (D003).

Following contract award, the Government will collaborate with the Contractor to review these frameworks and ensure they align with DoD Cyber Workforce Framework (DCWF) role standards and DoDM 8140 proficiency guidelines.

The final calibration criteria and proficiency mappings are subject to Government review and approval prior to operational implementation.

Can the Government identify the minimum programming languages expected to be supported (e.g., Python, Java, C#, JavaScript, C++, Go, Rust, etc.)?

A: Python and Java, but these needs will grow.

Should assessments include topics such as Generative AI, Prompt Engineering, Large Language Models (LLMs), MLOps, Deep Learning, and Responsible AI, or is the Government seeking assessment of traditional machine learning concepts only?

A: Yes, but the first need is assessment of Python and Java.

Can the Government clarify whether "MSL" refers to Microsoft SQL (MS SQL), MATLAB, or another technology?

A: MSL in this case refers to “Microsoft SQL Server

Are all 500 licenses expected to remain active simultaneously throughout the Period of Performance, or may licenses be reassigned as users complete assessments?

A: Ideally, licenses would be able to be rolled over to others if they go inactive after 60-90 days, but the tool should have the ability to support simultaneous use of all 500 licenses as this is a demonstration of our ability to scale for larger organizations with many more users.

Does the Government require integration with CAC authentication, Single Sign-On (SSO), SAML 2.0, Azure Active Directory, OAuth, or another enterprise identity management solution?

A: Yes.

Does the Government require the SaaS platform to possess a current FedRAMP Authorization, DoD Impact Level (IL) authorization, or other specific cloud security certifications?

A: No – commercial is acceptable for now.

. Beyond DFARS 252.204-7012 and related requirements, are there any additional CMMC, NIST SP 800-171, Zero Trust, or cybersecurity framework requirements applicable to this procurement?

A: No, but appropriate precautions must be used for PII data.

Are reports required only in PDF format, or should export capabilities include Excel, CSV, Power BI, dashboards, and/or API integration?

A: Export capabilities are required.

May contractors utilize commercially validated assessment libraries, or is the Government expecting development of custom assessment content?

A: Yes, but custom libraries will also be necessary. Vendor must demonstrate their ability to create custom assessments.

. Would adaptive assessments be considered acceptable provided they accurately measure competencies and produce standardized scoring?

. Does the Government require compliance with WCAG 2.1 AA or any additional accessibility standards beyond Section 508?

A: Yes WCAG 2.1 compliant

. Will user identification be limited to Government-issued identifiers, or should the platform be capable of securely storing names, email addresses, and other authorized user profile information?

A: DU will store identification information. The vendor must be compatible with this schema.

Are there any geographic hosting restrictions (e.g., CONUS-only hosting or U.S.-person administration requirements) applicable to the SaaS platform?

A: CONUS-only hosting.

Does the Government require real-time API integration with Digital University, automated course mapping, hyperlink-based recommendations, or manual alignment of assessment outcomes to available DU coursework?

May an offeror submit a quotation as the Prime Contractor utilizing a commercially available third-party SaaS platform under an authorized reseller, teaming, or implementation partnership arrangement, provided the Prime Contractor remains fully responsible for contract performance?

A: No.

- Will performance of this contract involve Covered Defense Information (CDI) or Controlled Unclassified Information (CUI) as defined under DFARS 252.204-7012, given that Section 6 of the PWS also states the system "must not store or process unauthorized PII"?

- If so, is a current NIST SP 800-171 Basic Assessment score in SPRS a prerequisite for award, or may an offeror's self-assessment and Plan of Action & Milestones (POA&M) be submitted with the quote and finalized during onboarding?

A: To align with the commercial nature of this requirement, a NIST SP 800-171 self-assessment score in the Supplier Performance Risk System (SPRS) is not required for award. As stated in previous Q&A responses, there are no additional security or DoD Impact Level (IL) requirements beyond what is stated in the PWS at this time. Vendors utilizing commercial hosting environments are acceptable, provided they employ appropriate precautions for any data handled by the system.

PWS

Q: The Addendum to FAR 52.212-1 (Instructions to Offerors) states vendors shall hold pricing firm for 30 days from the date specified for receipt of quotes, while the Addendum to FAR 52.212-2 (Evaluation Factors) states quotes shall remain valid for a minimum of 60 days. Could the Government confirm which validity period governs for this solicitation?

A: Firm for 30 days

A: No.

A: I don’t understand the question. What is job aid features?

A: As many as needed, up to multiple times daily.

. The PWS requires interoperability with Digital University (DU). Can the Government clarify the required integration mechanism (e.g., REST API, SSO, LTI, SCORM, file exchange, or another interface)? Will interface documentation and technical points of contact be provided after award?

A: The Government expects the Contractor's platform to support standard, secure web integration protocols—specifically REST APIs, Single Sign-On (SSO) utilizing SAML 2.0 or OpenID Connect (OIDC), and LTI (Learning Tools Interoperability).

The exact integration mechanism and data exchange schemas will be finalized post-award based on security requirements and the technical architecture of the target environments.

Detailed interface documentation, technical specifications, and direct program office points of contact (including the Digital University and BESPIN engineering teams) will be provided to the awardee immediately during the post-award onboarding phase.

. Will the Government require integration with an existing enterprise identity provider (e.g., CAC/PIV, Entra ID, SAML, OAuth, or Active Directory), or will contractor-managed authentication be acceptable?

A: Yes, integration with existing enterprise Single Sign On or equivalent

. May offerors utilize their existing commercial SaaS hosting environment provided all contractual security requirements are satisfied, or is a specific Government cloud environment required?

A: Yes. Gov cloud is not required at this time.

Beyond the requirements identified in the PWS, are there additional security or compliance requirements applicable to the proposed SaaS solution (e.g., FedRAMP authorization, NIST SP 800-171, STIG implementation, or Impact Level requirements)?

Will the Government provide existing assessment content or question banks for calibration, or is the Contractor expected to provide all assessment content as part of its commercial platform?

A: The Contractor is expected to provide all assessment content, question banks, technical rubrics, and evaluation materials as part of its commercial platform.

. Will the Government provide a catalog or metadata describing available Digital University courses for mapping recommendations, or is the Contractor expected to establish and maintain those mappings?

A: The Contractor is expected to establish and maintain those mappings.

Are there prescribed report templates or formats for the Quarterly Skills Gap Analysis Report and Final Performance Summary, or may offerors utilize standard commercial reporting capabilities?

A: Vendors may use standard commercial reporting capabilities if they align with DoW needs.

. The PWS specifies response and resolution timelines but does not identify required support hours. Should offerors assume standard business hours, Government business hours, or 24x7 support?

A: Government business hours

Will any existing assessment results or user history require migration into the Contractor's platform?

Deliverable D001 requires tenant access within five business days of award, while the Base Period begins on 15 July 2026. Should offerors assume the platform is expected to be fully operational and available for end users on the first day of the Period of Performance (15 July 2026), or does the Government anticipate a phased onboarding period following contract award?

A: The Government anticipates a phased onboarding, calibration, and integration period following contract award; however, core system provisioning must occur immediately.

The requirement for Deliverable D001 (Tenant Access) within five (5) business days of award is to ensure that Government administrators, security personnel, and integration teams have immediate access to the environment to begin configuration, Single Sign-On (SSO) integration, and security validation.

While the system's infrastructure must be live and accessible to the Government on day one of the Period of Performance (15 July 2026), the platform is not expected to be fully populated with end-users on that date.

General end-user access will be rolled out in a phased manner following the Government's review and approval of the Skill Circuit Calibration Plan (D003, due within 15 business days of award) and the successful completion of the initial system integration steps.

A: Detailed API documentation, technical specifications, and security protocols for Digital University (DU) will be provided to the awardee post-award. As previously noted, the platform is expected to utilize modern web standards such as REST APIs, SSO (SAML/OIDC), and LTI.

A: Yes. The Government, in coordination with the DU technical team, will facilitate access to a sandbox or testing environment post-award to ensure integration validation prior to system launch.

A: Yes, offerors should bundle all operational overhead—including annual hosting, maintenance, platform uptime assurance, and technical support—into the unit pricing of the 500 licenses under CLIN 0001. CLIN 0002 itself remains a no-cost line item.

A: The contractor is ultimately responsible for mapping, calibrating, and ensuring the alignment of their commercial assessment content with DoD frameworks. To facilitate this timeline, the Government will provide baseline reference materials—such as relevant job descriptions, role-based focus areas, or standard DoD competency frameworks—upon award. The contractor must utilize these baselines to deliver the completed Skill Circuit Calibration Plan (D003) within 15 business days.

A: Yes, CLIN 0001 will be invoiced the same day. The 500 Licenses will need to be ready for issue. CLIN 0002 is there to cover base period of the licenses as mentioned in the PWS (Task 7). For example if a license needs to be transferred to a new user the CLIN 0002 is there to cover the 12 months or remaining period of CLIN 0001.

A: No. There is no requirement for a specific DoD Cloud Computing SRG Impact Level (e.g., IL2, IL4, IL5) or FedRAMP Moderate authorization at this time. The system will operate as a standard commercial multi-tenant SaaS accessed over the public internet, provided it adheres to standard DFARS data protection clauses and CONUS-only hosting.

A: None – admin accounts, if necessary, would be provided as well. All 500 licenses are for assessment purposes.

A: Yes. The platform must accommodate and assess users across multiple proficiency levels, ranging from beginners to expert practitioners. The calibration phase (Deliverable D003) will be used to map and align these assessment levels with DoD frameworks.

A: No, email delivery and basic hyperlinking alone do not fully satisfy the interoperability requirement. While linking to DU courses from the platform is a required component, the platform must also support programmatic integration (e.g., via REST APIs, SSO, or LTI) to ensure a seamless user experience and consistent tracking, as outlined in the PWS.

A: Interoperability requires the platform to integrate with DU via industry-standard web protocols. Specifically, the platform must support Single Sign-On (SSO) for user authentication and REST APIs or LTI standards to pass relevant course recommendations or progress tokens back to DU, ensuring users do not have to manage separate logins. Technical specifications will be finalized post-award.

A: Yes, the use of commercial AI agents or algorithmic recommendation engines for skill mapping and course suggestions is acceptable. However, the vendor is responsible for ensuring the AI operates securely within their commercial SaaS environment, does not require the input of high-risk PII/PHI, and adheres to the stated CONUS-only hosting constraints.

Platform specificity: Does this requirement specify a particular commercially available SaaS platform, or will an "or-equal" commercial SaaS solution that meets all PWS performance standards be acceptable? If a specific product (e.g., the referenced "Skill Circuit" solution) or an incumbent platform is intended, could it be identified?

A: The Government will accept any functionally equivalent, commercially available platform that meets all requirements of the PWS. The requirement is not tied to a specific commercial brand or proprietary product. "Skill Circuit" is a general conceptual term for the skill path mapping rather than a mandatory brand-name software product.

Reseller/partner arrangement: Will the Government accept a quote in which a Vendor, as prime, provides a commercial SaaS platform through an authorized reseller/partner arrangement?

Licenses: Are the 500 licenses named-user or concurrent?

A: The 500 licenses are re-assignable named-user licenses. The licenses form a fixed pool of 500 seats that the Government can reassign over the course of the contract (for example, reassigning a seat after 60-90 days of inactivity). They are not concurrent-use floating licenses.

Submission: Please confirm the required quote format and submission method (email to the POCs vs. completed SF 1449), and any reps/certifications required beyond an active SAM registration (FAR 52.212-3).

A: Yes, please email completed SF 1449 with filled out with quote to POC’s listed within instructions to offerors.