RFI_JCO Follow-on.pdf

DISTRIBUTION STATEMENT A - Approved for Public Release; Distribution Unlimited.

Request for Information (RFI) For Air Force Life Cycle Management Center

(AFLCMC) Joint Cyber Command and Control

(JCC2)

Cyber Operations (JCO) Development Support

18 September 2025

1. Introduction This request for Information (RFI) is published only to obtain information for use by the Air Force Life Cycle Management Center (AFLCMC), Joint Cyber Command and Control (JCC2), Joint Base San Antonio – Lackland AFB, Texas, for planning purposes only.

RFI does not constitute an invitation for Bids, Request for Proposal (RFP), Solicitation, Request for Quote (RFQ) or an indication that the Government will contract for the services provided by submitter. The Government will not reimburse respondents for any costs associated with the preparation or submission of the information requested. Response to this RFI is strictly voluntary and will not affect any potential vendor's ability to submit an offer should a solicitation be released. Any requests for a solicitation package will be disregarded.

The Government does not intend to award a contract based on this RFI or otherwise pay for the information solicited. No entitlement to payment of direct or indirect costs or charges by the Government will arise as a result of preparing submissions in response to this RFI and the Government's use of such information.

The determination of a procurement strategy based upon the information submitted is solely within the discretion of the Government.

Submittals will not be returned to the sender. Respondents to this RFI may be requested to provide additional information/details based on their initial submittals.

2. Objective AFLCMC/HNCJ is seeking industry input for advancing JCC2 Cyber Operations (JCO) (previously known as IKE), a Joint Cyber Command and Control (JCC2) capability. JCO is a platform that enables operators to manage missions throughout the entire mission lifecycle as well as visualize mission data and operational environments. Decision makers, planners, analysts, readiness managers and operators at all Joint Cyber C2 echelons will benefit from this capability. The JCO system characteristics will include enhanced interoperability from cloud computing reference architectures, integrated infrastructure, leverage a cross-domain solution across security enclaves (e.g., NIPR, SIPR, JWICS) and containerized solutions. The cloud computing infrastructure, built on enterprise level services, will also include DevSecOps platform services to support SAFe/Agile software development and production delivery efforts. The SAFe/Agile development will provide immediate benefit through early delivery of incremental value as opposed to long development cycles experienced through waterfall development efforts. Using a SAFe/Agile methodology to develop rapid IT acquisition techniques, JCO will expand upon existing technology solutions to integrate with Joint C2 capabilities. USCYBERCOM and Joint commanders have access to fuse information that is delivered at the pace of the operating environment empowering multi-domain decision-making.

JCO is a mission orchestration, automation, and analysis platform that empowers users at organizational levels to plan and manage all-domain operations and facilitate decision making.

Enabled by Machine Learning and Artificial Intelligence capabilities, JCO synthesizes disparate data and consolidates multiple lenses of high-dimensional challenges into a common view to accelerate and scale all-domain missions with amplified effects. JCO is a program of record with JCC2 Battle Management (BM) and operationally deployed in support of real-world cyber mission execution. It is the authoritative data source for all OCO and DCO mission planning.

3. Requested Information All respondents are requested to submit a white paper (no more than 15 pages total) that includes the following information:

1. Is your company CMMI Level 4 in Services or IT? If so, how long have you held this certification?

2. Do you have experience using DevSecOps for deploying new capabilities through application development, sustainment, and containerization integration in a SAFe/Agile framework? Provide contracts/efforts your company has supported to satisfy this. Annotate if you were the prime or a sub-contractor on each contract/effort.

3. Do you have experience in providing scalable enterprise command and control (C2) solutions? Provide contracts/efforts your company has supported to satisfy this. Annotate if you were the prime or a sub-contractor on each contract/effort.

4. Regarding the technical questions below, the government would like to review industry’s experience with, but not limited to, the following languages/applications/technologies on NIPR, SIPR, and JWICS:

Version Control & Collaboration

Build & Automation

Jenkins Maven Github Enterprise Webpack GitLab Packer Buildgraph Docker Compose Bitbucket General Concepts Jira Artificial Intelligence (AI) Confluence Machine Learning (ML) Programming Languages API (Application Programming Interface) –

(All types – REST, SOAP, GraphQL, etc.)

Python Testing & Linting Go Flake8 NodeJS Puppeteer Angular Cypress.io React Cloud & Containerization

Java Docker Artifact Repositories Kubernetes Artifactory Openshift Nexus EKS (Elastic Kubernetes Service) Docker Registry Databases Security PostgreSQL HP Fortify Cloud Services Sonarqube ELK Stack (Elasticsearch, Logstash, Kibana) Twistlock (now Palo Alto Networks Prisma Cloud)

AWS Cross Domain

Anchore Nessus Ember

Provide details regarding experience and how many years for each of the languages/applications/technologies. Provide contracts/efforts your company has supported to satisfy this? Annotate if you were the prime or a sub-contractor on each contract/effort.

5. Do you have experience with containerization and container orchestration tools that are currently supporting the service cyber community operational needs (e.g., transitioning to Kubernetes) and if so which ones? Provide contracts/efforts your company has supported to satisfy this. Annotate if you were the prime or a sub-contractor on each contract/effort.

6. Do you have experience taking over sustainment and development of software baseline produced by another organization? If yes, please provide details (e.g., steps taken, processes) regarding transition and how long before you were able to start developing and delivering new capabilities to the user community. Provide contracts/efforts your company has supported to satisfy this. Annotate if you were the prime or a sub-contractor on each contract/effort.

7. Do you have experience developing application(s) that ingest from multiple sources, aggregate, analyze, and convert raw data into decision quality information and display information in visualization dashboards. For each application you have developed, identify the total number of users and/or active users and in what domain (i.e., NIPR, SIPR, JWICS) it was hosted on. Provide contracts/efforts your company has supported to satisfy this. Annotate if you were the prime or a sub-contractor on each contract/effort.

8. Based on the previous response contract/efforts supported (question #7), can you provide the labor skill mix and quantity of each position (front-end developer, back-end developer, database engineer, etc.) required to deliver capabilities to the user community.

9. Do you have experience with integration with IONIC (Big Data Platform) and

AccessIT? Provide contracts/efforts your company has supported to satisfy this.

Annotate if you were the prime or a sub-contractor on each contract/effort.

10. Do you have experience developing and maintaining operational software in a Government Cloud environment (e.g., Amazon Web Services (AWS))? Provide contracts/efforts your company has supported to satisfy this. Annotate if you were the prime or a sub-contractor on each contract/effort.

11. Provide a list of active government contract vehicles to access your services with contract POCs.

4. Responses We are looking at the following NAICS codes. If you believe there are others that would apply to this effort, please let us know.

518210 541511 541512 541519

This is not a solicitation, but a Source Sought for market research purposes only. Interested parties are requested to respond to this RFI with a white paper that is Microsoft Office 2016 suite or PDF compatible, no smaller than size 10 Font, and searchable. Diagrams should be in either a standard image, PDF, or Microsoft Office 2016 compatible format. White papers are due no later than Noon CDT, 1 October 2025 to the POCs shown in Section 5.

Whitepaper submission. Proprietary information, if any, should be minimal and MUST BE CLEARLY MARKED. To aid the USG, please segregate proprietary information. Please be advised that all submissions become USG property and will not be returned.

The highest classification of the responses will be no higher than UNCLASSIFIED//

CONTROLLED UNCLASSIFIED INFORMATION (U//CUI)

5. Contracting Points of Contacts (POCs):

Point of Contact: Capt Melvin Mitchell, Contracting Officer, aflcmc.hncj.contracting@us.af.mil Point of Contact: Ms. Star Jimenez, Contract Specialist, star.jimenez@us.af.mil

6. Industry Discussions JCC2 PMO representatives may, or may not, choose to schedule in person briefings with potential vendors. Such discussions and/or capability demonstrations would only be intended to get further clarification of potential capability to meet current sustainment and new emerging development requirements.

7. Questions Submit questions for this announcement to POC’s identified in Section 5 via email. Verbal questions will NOT be accepted. The Government does not guarantee any responses to questions received after Noon CDT, 1 October 2025.

8. Summary THIS IS A REQUEST FOR INFORMATION (RFI) ONLY to identify industry sources that can provide JCC2 Cyber Operations development and capabilities. The information provided in the RFI is subject to change and is not binding on the Government. The USG has not made a commitment to procure any of the items discussed, and release of this RFI should not be construed as such a commitment or as authorization to incur cost for which reimbursement would be required or sought. All submissions become USG property and will not be returned.