QA_N66001-26-R-3507.pdf

Questions & Answers for N66001-26-R-3507 as of 27APR2026

Q1. Attachment 2: Reference Information Sheet, Section 9 states that respondents should describe how the work demonstrates capability to perform the key areas. This section also contains a parenthetical stating “For primes

(only),” and then lists additional items that respondents should address. Does the “for primes (only)” pertain to the additional items that respondents should address? Or does “for primes (only)” mean that only prime references are permitted for Attachment 2?

If your company performed the effort relevant to this sources sought as a subcontractor, then yes that refence may be considered. However, if your company is submitting a reference, for a proposed subcontractor that performed work related to this effort, that reference would not be relevant or evaluated.

Regarding the distinction in box 9, which states: “Describe how the work demonstrates capability to perform the key areas. (For primes (only), describe management infrastructure, capacity to procure, and ability to execute and manage the effort).” – You may address the first sentence to describe how work as a subcontractor demonstrates capability to perform the key areas. However, using this box to describe management infrastructure, capacity to procure, and ability to execute and manage the effort for a reference in which you were a subcontractor would not be evaluated as partially capable if included. We are only looking for responses to those areas in which you acted as the prime.

Q2. What are the top technical pain points in the current AA implementation?

The current AA implementation is primarily hindered by manual testing overhead and the complex technical requirements of deploying to DDIL environments. These challenges underscore a critical need for CI/CD pipeline improvements to ensure agile and reliable software delivery at the tactical edge.

Q3. Which parts of the current architecture are fixed constraints, and which are open to redesign?

The architecture is governed by fixed environmental and security constraints, specifically edge environments, networks, the Software Factory, and mandatory Department of War (DoW) cyber compliance. Within this secure framework, we maintain full flexibility to redesign the internal architecture, user interfaces, and the selection of

COTS or OSS products. Furthermore, our testing methodologies and operational processes remain open for optimization to enhance mission efficiency and delivery speed.

Q4. Where do deployments succeed, and fail, most often today across ashore, afloat, OCONUS, and autonomous targets?

Deployment success is heavily dictated by the stability of the target environment. Ashore and fixed OCONUS deployments succeed most often due to stable, high-bandwidth infrastructure. Tactical OCONUS and Autonomous deployments face higher risks from network latency and strict over-the-air update constraints. Afloat environments experience the highest failure rates; Application Arsenal installs with minimal problems afloat, the applications deployed through the Arsenal experience a higher failure rate. This discrepancy is primarily driven by external operational factors, including network constraints, deferred platform maintenance, and the varying system readiness levels of the receiving ships.

Q5. What is the current model for software artifact packaging, signing, replication, and installation?

Currently, there is a clear separation of duties in the software delivery pipeline. Software artifact packaging and cryptographic signing are conducted securely within the software factory. Once the artifacts are ready, Application

Arsenal takes over to manage replication and installation at the tactical edge. To accommodate diverse network conditions, Application Arsenal supports both push and pull replication models. Finally, it equips the warfighter with a streamlined user interface to seamlessly install authorized software directly into their operational environment.

Q6. What are the biggest current bottlenecks in RMF/cyber compliance and release approval?

The lack of automation and standardized, machine-readable evidence generation for RMF/Cyber compliance is currently the biggest bottleneck regarding authorization efforts.

Q7. What is the desired future-state architecture over the next 3–5 years?

Application Arsenal currently delivers on a quarterly cadence. The future-state architecture will be infrastructure-agnostic, ensuring that warfighting software is deployable wherever the mission requires, without the friction of platform-specific re-engineering.

Q8. Is the Government open to a more modular, OCI-based, package-driven architecture that reduces the sustainment burden and improves portability?

Yes. Application Arsenal is highly receptive to a modular, OCI-based, package-driven architecture, especially where it demonstrably reduces the sustainment burden and enhances portability. Currently, Application Arsenal utilizes and fields OCI-compliant images supplemented with specific custom configurations.