RFI_Cross-Domain Capabilities_23Oct26_v2.docx

Request for Information (RFI) Raise the Bar (RTB)–Aligned Cross-Domain Capabilities for U.S. Army Enterprise and Tactical Environments

Notice This Request for Information (RFI) is issued solely for market research and acquisition-planning purposes. It is not a solicitation, request for proposal (RFP), request for quotation (RFQ), or commitment by the Government to issue a solicitation or award a contract. The Government does not intend to award a contract based solely on responses to this RFI and will not reimburse respondents for costs incurred in preparing or submitting responses.

Any future acquisition, deployment, connection, authorization, or operation of cross-domain capabilities will be subject to applicable U.S. Army, Department of War (DoW), National Cross Domain Strategy and Management Office (NCDSMO), cybersecurity, intelligence, foreign-disclosure, acquisition, and other statutory policies and approval processes. References to NCDSMO “Raise the Bar” (RTB) identify desired alignment with applicable cross-domain security objectives. Such references do not, by themselves, constitute certification, accreditation, authorization, approval, or acceptance by NCDSMO, the U.S. Army, or the DoW.

Responses should adhere to National Manager for National Security Systems Emergency Directive ED-2023-005 (Reducing Risk of Cross Domain Solutions on Internet-Accessible Networks) and NCDSMO-R-00011-001_01, including requirements or limitations relevant to the proposed capability and operating environment.

1. Purpose and Background The U.S. Army, Product Manager Communications Security (PdM COMSEC), is seeking information from industry to support market research, technical requirements refinement, and acquisition planning for next-generation cross-domain capabilities. The Government is interested in identifying mature, commercial-off-the-shelf (COTS), government-off-the-shelf (GOTS), and near-term developmental solutions aligned with applicable NCDSMO “RTB 5.1 or newer” requirements capable of operating across U.S. Army enterprise, tactical, edge, and expeditionary environments.

Desired capabilities must support secure, controlled, policy-enforced information exchange among:

U.S. Army enterprise and tactical internal networks;

Commercial and GovCloud environments, specifically DoW Impact Level 5 (IL5) and Impact Level 6 (IL6);

Multiple security classification domains (Secret and Below, Unclassified, Coalition, and higher security enclaves);

High Threat Networks (HTN) and Internet-accessible or untrusted mission partner segments;

Forward tactical, mounted, dismounted, and expeditionary operational nodes subject to size, weight, and power (SWaP) constraints;

Mission partners, including:

Five Eyes (FVEY) networks;

Combined Joint All-Domain Command and Control (CJADC2) federations;

Coalition, bilateral, and authorized multinational networks.

The Government intends to use industry responses to evaluate market readiness, validate system integration feasibility, identify cyber vulnerabilities and supply chain risks, analyze tactical deployment viability, and shape upcoming program acquisition strategies.

2. Priority Capability Areas Respondents are requested to address the capability areas detailed below. To provide actionable engineering data to the Government evaluation team, respondents should provide specific technical details, architecture diagrams, benchmark data, and accreditation evidence where available.

A. Cross-Domain Security and RTB 5.1+ Alignment Describe how the proposed capability achieves or plans to achieve compliance with NCDSMO RTB 5.1 (or newer) standards:

Transfer & Access Modes: Detail support for one-way transfers, bidirectional interactions, and remote browsing/access functionality across Secret and Below (SAB) and multi-enclave environments.

NCDSMO Baseline Status & Roadmap:

Identify current NCDSMO status (e.g., Listed on Baseline, In Lab Testing, Pre-Assessment, Not Listed).

Specify known deviations, waivers, or remediation timelines against RTB 5.1/5.2 requirements.

Provide historical milestone dates and forecasted calendar year (CY) schedules for security testing, delta evaluations, government lab assessments, operational fielding, and planned end-of-life/sunset phases.

Classification & Profile Designations:

Detail whether the system is evaluated as a Tactical Cross Domain Solution (TCDS), Datacenter-Class Cross Domain Solution (DCCDS), or Enterprise Access CDS.

Detail physical or logical domain separation mechanisms across boundary interfaces.

B. Operational Use-Case Scenarios To enable direct comparison and validate practical operational viability, explain how your solution addresses the following representative Army use cases:

Scenario 1: Tactical Sensor-to-Shooter & Intelligence, Surveillance, and Reconnaissance (ISR) Streaming (HTN / Tactical to Enclave)

Operational Context: Real-time ingestion of Full Motion Video (FMV) (e.g., Moving Picture Experts Group Transport Stream (MPEG-TS) / H.264 / H.265 / Key-Length-Val (KLV) metadata) and associated Cursor-on-Target (CoT) XML feeds from unmanned aerial or ground platforms operating in contested/high-threat environments into an enterprise or brigade Tactical Operations Center (TOC) enclave.

Required Response: Describe how the architecture sanitizes, inspects, and re-encapsulates streaming data at line rate without introducing unacceptable end-to-end latency.

Scenario 2: Automated Cross-Enclave Database & Situational Awareness Replication

Operational Context: High-frequency, bidirectional or unidirectional transactional replication of Common Operating Picture (COP) data, relational database records (e.g., PostgreSQL, SQL Server), or microservice message queues (e.g., Apache Kafka, RabbitMQ) between Secret and coalition/unclassified enclaves.

Required Response: Describe schema validation, database trigger integration, message broker bridging, and deep payload inspection mechanisms.

Scenario 3: Secure Intelligence Pull & Interactive Web Browsing (Browse-Down / File Pull)

Operational Context: Intelligence analysts on a classified workstation interactively searching, previewing, and retrieving vetted documents (e.g., PDF, Office XML), imagery National Imagery Transmission Format (NITF), and unstructured files from open-source intelligence (OSINT) or coalition repositories.

Required Response: Describe session isolation, pixel rendering/Virtual Desktop Infrastructure (VDI) offloading, file sanitization (CDR - Content Disarm and Reconstruction), and defense against drive-by exploits.

C. Data Format Specificity and Deep Content Inspection CDS must execute deterministic deep content inspection and filtering. Provide clear answers regarding format support:

Native vs. Custom Inspection Support: Populate and/or detail native, out-of-the-box filtering capabilities versus formats requiring custom adapter or filter development for the following standards:

Imagery & Geospatial: NITF 2.1, GeoTIFF, JPEG 2000, KML/KMZ, ESRI Shapefiles.

Tactical Messaging: Cursor-on-Target (CoT), USMTF, VMF (Variable Message Format), Link 16 J-series over IP.

Structured Data & Streaming: JSON, XML, Protocol Buffers (Protobuf), Apache Avro, YAML.

Streaming Media: MPEG-TS, RTSP, RTP, STANAG 4609 compliant metadata.

Documents: PDF (ISO 32000 / PDF/A), OpenXML (DOCX, XLSX, PPTX), plain text/CSV.

Filter Pipeline Architecture: Explain the pipeline execution order (e.g., schema validation, size limits, structural sanitization, keyword whitelisting/blacklisting, steganography detection, embedded macro stripping, hash verification).

Filter Rule Authoring & Deployment Lifecycle:

Detail the workflow, toolsets, and skill levels required for Army personnel or integrators to develop, validate, and deploy new filter rules or schemas.

State the typical cycle time required to author, test, and activate a new or updated schema filter rule.

D. Performance, Scalability, and Workload Benchmarks Provide empirical or modeled performance metrics under real-world operating conditions:

Performance Under Operational Load:

Provide verified or estimated throughput (Gbps/Mbps) and packet/message processing latency (milliseconds) when subjected to:

Sustained high-throughput bulk file transfer (e.g., mixed 1 MB to 100 MB files).

High-rate, low-latency streaming metadata (e.g., 5,000+ CoT messages/sec).

Concurrent full-motion video feeds (e.g., 20+ concurrent 1080p H.264 streams).

Concurrent Connections & Capacity Limits:

Maximum concurrent sessions, Transmission Control Protocol (TCP) connections, or independent data flows supported without degradation.

High Availability and Elastic Scalability:

Detail failover architecture, active-passive vs. active-active clustering, session failover times, and state synchronization across nodes.

Describe horizontal and vertical scalability mechanisms in tactical edge nodes versus enterprise cloud architectures (AWS GovCloud, Microsoft Azure Government).

E. HTN Protection and Hardware Enforcement Detail how your system complies with NCDSMO Acceptable Design Patterns when bridging HTN or untrusted interfaces:

Hardware-Enforced Isolation: Detail implementation of hardware data diodes, optical isolators, and Protocol Filtering Diodes (PFDs).

Hardware Content Filtering Devices (HCFD): Describe integration of dedicated hardware-based filters (e.g., FPGA, ASIC, or isolated micro-engines) operating independently of general-purpose operating systems.

Rule of Three Multi-Stage Filtering: Explain conformance to the NCDSMO "Rule of Three" architecture:

Stage 1: Outer protocol termination, validation, and ingress rate limiting.

Stage 2: Hardware-enforced one-way separation / intermediate verification.

Stage 3: Deep syntactic, semantic content verification, schema validation, and sanitization.

F. Defensive Cyber Operations (DCO), Application Programming Interface (API), and Enterprise Automation To reduce operational administrative burden in contested and distributed environments:

API Automation:

Is full lifecycle administrative control accessible via a secure, documented RESTful API or CLI (e.g., configuration management, automated rule updates, key/certificate rotation, health checks, log retrieval)?

Can the system be automated via Infrastructure-as-Code (IaC) tools (e.g., Ansible, Terraform)?

Security Information and Event Management (SIEM) / Security Orchestration, Automation, and Response (SOAR) Telemetry:

Specify native log output formats (e.g., Syslog RFC 5424, CEF, JSON, OpenTelemetry).

Identify pre-built dashboards, inputs, or Technical Add-ons (TAs) for enterprise platforms (e.g., Splunk, Elastic, DoW Big Data Platform).

Provide a sample alert/log schema for an invalid schema rejection or security policy breach.

Contested & Degraded Environment Resiliency:

Describe system behavior during degraded, intermittent, or limited (DIL) network links and complete severance of centralized communications.

Detail buffering, local queueing, self-healing, and automatic resynchronization mechanisms once connectivity is restored.

G. Tactical Suitability, SWaP-C, and Environmental Hardening For tactical, vehicle-mounted, edge, and expeditionary variants:

Physical Specifications (SWaP): Form factor (standard 19-inch rack units, Air Transport Rack (ATR) chassis, half-rack, transit case), physical dimensions, dry weight, and maximum power consumption (AC/DC voltage requirements).

Environmental & Ruggedization Standards: Testing and certification status against:

MIL-STD-810H (Shock, vibration, extreme temperatures, humidity, altitude).

MIL-STD-461G (Electromagnetic compatibility and emissions).

TEMPEST / NSTISSAM TEMPEST/2-95 compliance or separation design.

Anti-Tamper (AT) / zeroization capabilities (e.g., physical tamper switches, cryptographic zeroize, cryptographic mesh).

Field Maintenance & Survivability: Mean Time Between Failures (MTBF), Mean Time to Repair (MTTR), internal battery replacement cycles, and field-swappable module provisions.

H. Assessment and Authorization (A&A) & Past Performance Provide tangible evidence of authorization readiness:

Accreditation Evidence Package: Detail the security artifacts available to support an Army Approving Official (AO) and the NCDSMO authorization process (e.g., DISA STIG compliance checklists, automated vulnerability/ Security Content Automation Protocol scan results, architectural security descriptions, Risk Management Framework [RMF] control implementation summaries).

Historical Authorizations: List previous or active DoW, Intelligence Community (IC), or federal CDS authorizations (e.g., Authorization to Operate, Interim Authority to Test [IATT], Combatant Command fielding approvals). Specify the accreditation baseline version (e.g., RTB 4, RTB 5), authorizing body, and deployment environment (tactical or enterprise).

3. Additional Requested Information Detailed responses to Priority Capability Areas (Sections 2.A through 2.H).

Architecture diagrams illustrating data flow, protocol termination, inspection stages, and hardware isolation barriers.

Capability Maturity & Roadmap:

Current Technology Readiness Level (TRL) and Manufacturing Readiness Level (MRL).

Production lead times, commercial availability, and roadmap for future RTB upgrades.

Risk & Dependency Assessment:

Detailed risk matrix outlining technical, schedule, certification/lab backlog, supply chain (including Section 889 and NDAA compliance), and obsolescence risks, with corresponding mitigation strategies.

Cost Modeling & ROM Pricing:

Non-binding Rough Order of Magnitude (ROM) pricing broken down by:

Base hardware/software appliance licensing.

Annual software assurance, security patch maintenance, and tier 3/4 engineering support.

Custom filter/adapter development services and NCDSMO testing support.

Training and lifecycle field sustainment.

4. Submission Guidelines WRITTEN RESPONSES. Interested parties are requested to respond to this RFI. Written responses shall be in Microsoft Word for Office 2000 compatible format. Responses shall be limited to 10 pages for the entire submission (including company information, supporting documentation, etc.) Responses are due NLT 20 NOVEMBER 2026, Noon and must be submitted via SAM.gov portal or e-mail with SUBJECT Line “Cross Domain Capabilities– (Your Company Name)” to the below Government Point of Contacts (POCs):

Jolene Sloley (Contract Specialist) – jolene.m.sloley.civ@army.mil and Tom Lynn (Contracting Officer) - thomas.e.lynn23.civ@army.mil.

Please do not submit to both.

Proprietary information, if any, should be minimized and MUST BE CLEARLY MARKED. To aid the Government, please segregate proprietary information (included in the page limit). Please be advised that all submissions become Government property and will not be returned.

Respondents may provide supplemental information such as product brochures, specification sheets, photographs, illustration and technical descriptions that describe your company’s current products that most closely match these capabilities described above. Contractors are encouraged not to include marketing informational materials that do not relate to the products recommended for consideration, as they will be discarded. However, responses may include universal resource locater (URL) links to technical documentation materials (i.e., technical data sheet).