RFI FAQs Ammendment 1.pdf

SOURCES SOUGHT NOTICE / REQUEST FOR

INFORMATION (RFI)

RFI FAQ’s (AMENDMENT 01)

Notice ID: N00019-26-RFPREQ-WPM281-0281

Title: PMX-281 IT Strategy, Software Modernization, and Digital Decision

Intelligence Advisory Subscriptions

Issuing Agency: Naval Air Systems Command (NAVAIR) / PMA-281

Date: November 5, 2026

Question 1:

Does the Government require the commercial research and advisory subscription portal to operate at Department of Defense (DoD) Cloud Computing Security

Requirements Guide (SRG) Impact Level 4 (IL4) or higher?

Government Response:

No. The Government does not require the commercial research and advisory portal, document repository, or benchmark database to operate at DoD Impact Level 4

(IL4) or IL5.

The primary scope of the subscription is to deliver commercial research, market assessments, technology benchmarks, and analytical toolsets produced and maintained by the commercial provider. Access to this commercial library does not require the Government to furnish Controlled Unclassified Information (CUI).

Platforms operating under standard commercial/federal cloud security controls

(e.g., SOC 2 Type II, FedRAMP, or equivalent commercial hosting standards) are acceptable for the subscription repository portion of this requirement.

Question 2:

How will Controlled Unclassified Information (CUI), export-controlled (ITAR/EAR) data, or classified discussions be managed if the commercial subscription platform is not IL4?

Government Response:

In accordance with Section 4.0 of the draft Statement of Work (SOW), performance requirements are as follows:

1. Commercial Research & Analytical Toolsets: Unclassified, commercially published materials are accessed directly via the contractor's secure commercial web portal.

2. Advisory Inquiries & Technical Engagements: Any advisory interactions, technical roadmapping, or document reviews involving CUI, ITAR-controlled technical data, or classified information will be conducted exclusively via approved Government communication environments (e.g., NMCI, encrypted DoD email) or in-person within Government-accredited facilities (SCIFs at NAS

Patuxent River).

Offerors will not store, process, or transmit CUI or classified data on their commercial research platform.

Question 3:

What are the facility and personnel security clearance requirements for this effort?

Government Response:

As outlined in SOW Section 4.0 and the accompanying DD Form 254:

• Facility Security Clearance (FCL): Offerors must possess and maintain a TOP

SECRET Facility Security Clearance (classified processing and storage will take place solely at Government facilities).

• Personnel Clearances: Designated Executive Advisors and domain-expert analysts conducting classified or sensitive advisory sessions must hold or be eligible for Top Secret / Sensitive Compartmented Information (TS/SCI) clearance.

• Citizenship: All personnel supporting Government inquiry sessions and advisory engagements must be United States citizens.

Question 4:

Does the Government have specific restrictions regarding the use of inquiry topics or submitted draft documents with commercial Artificial Intelligence (AI) / Large

Language Models (LLMs)?

Government Response:

Yes. In accordance with SOW Section 3.2.14, any Government-provided documentation, draft system architectures, technical requirements, or program discussions shared with the contractor remain the exclusive property of the U.S.

Navy. The contractor is strictly prohibited from ingesting, storing, processing, or using any Government-provided data or inquiry content to train, fine-tune, or validate any commercial artificial intelligence, machine learning, or large language model. Access to Government materials must be strictly restricted to the analysts assigned to perform the review.