University Incubator RFI.docx

REQUEST FOR INFORMATION (RFI)

Assessment on Potential Establishment of Incubator Programs for Secure Facilities and Networks at Universities

Purpose Pursuant to Section 1071 of Public Law 119-60, the National Defense Authorization Act for Fiscal Year 2026 (Section 1071), the Department of War (DoW) is conducting an assessment on the feasibility, advisability, and potential benefits of establishing incubator programs for the development, operation, and sustainment of secure facilities and networks at select institutions of higher education.

This RFI seeks detailed information from institutions capable of:

· Establishing or expanding secure facilities and networks

· Accelerating the transition of innovative technologies to DoW mission use

· Increasing availability of secure spaces to support classified research and development (R&D), prototyping, secure collaboration, and research transition activities

· Expanding the cleared technical workforce

· Serving as a regional innovation hub supporting multi-tenant use (DoW, industry, and academia)

· Long-term economic sustainment with significant non-federal cost-sharing

For the purpose of this RFI, secure facilities refers to facilities that meet Intelligence Community Directive 705 "Sensitive Compartmented Information Facilities," and 32 Code of Federal Regulations Part 117, “National Industrial Security Program Operating Manual (NISPOM)” requirements and are sponsored by the U.S. Government to support classified work. These include Sensitive Compartmented Information Facilities (SCIFs), Special Access Program Facilities (SAPFs), and facilities approved for work with Confidential, Secret, and Top Secret (also known as collateral classified) information. Secure networks may refer to government-provided classified networks, as well as government-authorized contractor-developed classified networks.

The Department intends to use RFI responses to inform its assessment to Congress on the feasibility, advisability, and potential benefits to the Department of establishing the incubator programs described in Section 1071.

The purpose of this information request is to ensure that any potential assessment provided to Congress and any subsequently authorized incubator program are grounded in realistic construction, security, governance, and sustainment planning. Early identification of cost, compliance, and institutional commitment factors is intended to reduce risk for both the U.S. Government and participating institutions.

The Department recognizes that preparation of responses will require coordination across executive leadership, facilities, IT, security, and legal offices. The response window has been calibrated to balance thorough planning with the statutory timeline for submission to Congress.

This RFI is for planning and assessment purposes only and does not constitute a solicitation.

Eligibility Respondents must meet the definition of “institution of higher education” under Section 101 of the Higher Education Act.

Institutions located in Established Program to Stimulate Competitive Research (EPSCoR)-eligible states are strongly encouraged to respond.

Requested Information Institutions should respond to the following sections in the format provided. Institutions are encouraged to consider innovative, cost-effective approaches and teaming arrangements.

Institutions with no fully functional secure facility are eligible and encouraged to respond, consistent with Section 1071 criteria. Where any institution does not have direct experience or an existing program in response to any of the items below, institutions may respond with their planned roadmap, timeline, and estimated cost to develop and implement programs to the described standard.

Institutions that do currently have secure facilities are encouraged to thoroughly describe the gap their participation in this type of program would fill for the Department.

Section A – Current Security Posture and Gaps

1. Current Facility Clearance (FCL) status, if any.

1. Current secure facility status:

1. Do you operate a SCIF(s)?

1. Do you operate classified labs? At what classification?

1. Do you operate accredited classified IT networks? Which systems? At what level? In which SCIF and/or classified spaces?

1. Current number of faculty, staff, and students holding active clearances (by clearance level).

1. Identification of gaps preventing expanded classified research.

Section B – Institutional Commitment to National Security Note if any of the answers below include classified work.

1. Existing DoW-funded research portfolio (total value and sponsors).

1. Description of national security related R&D activities.

1. Description of Research Security program in accordance with National Security Presidential Memorandum 33

1. Description of Cybersecurity Maturity Model Certification status.

1. Mechanisms for supporting students through the personnel security clearance and classified proposal processes.

1. Existing programs aligned with national security workforce needs.

1. Partnerships with defense contractors employing cleared graduates.

Section C – Industry and Government Partnerships Note if any of the answers below include classified work.

1. Existing Cooperative Research and Development Agreements (CRADAs), Other Transaction Authorities (OTAs), or other agreements with DoW or defense industry.

1. Identified industry partners willing to co-use secure facilities.

1. Evidence of demand for classified meeting or R&D space in the region.

1. Regional innovation ecosystem overview.

1. Opportunities for cost-sharing or other State economic development incentives if your institution were to build or expand secure facilities.

1. Institutions should describe their plans for regional collaboration, including:

3. Partnerships with other universities, national labs, and defense contractors in the region.

3. Strategies for leveraging regional resources to support the incubator program.

3. Plans for fostering innovation ecosystems that benefit the broader national security community

Section D – Technical Capabilities Relevant to Defense Innovation Priorities Note if any of the answers below include classified work.

1. Identification of top 3-5 research domains aligned to DoW priorities (e.g., AI/ML, microelectronics, hypersonics, autonomy, cyber, biotech, quantum, energy resilience, space systems).

2. Examples (last 5 years) of technologies transitioned or licensed to DoW or defense industry.

3. Description of existing technical infrastructure relevant to classified R&D (instrumentation, labs, high performance computing, test ranges, fabrication facilities, etc.)

Section E – Administrative Capacity and Experience and Operations Security Readiness

1. Description of policies for co-use agreements involving industry partners, other Federal agencies, or State or Tribal partners.

2. Description of institution’s compliance with U.S. export control laws, including the International Traffic in Arms Regulations (ITAR) and Export Administration Regulations (EAR). The response should include:

· Policies and procedures for managing export-controlled research.

· Training programs for faculty, staff, and students on export control compliance.

· Mechanisms for monitoring and enforcing export control regulations.

3. Statement signed by the Chief Information Officer, Chief Information Security Officer, or equivalent senior technical official articulating the institution’s commitment to protecting DoW information and supporting DoW cybersecurity objectives.

· The statement should describe how the institution:

· Prioritizes cybersecurity at the enterprise level;

· Aligns with DoW cybersecurity standards and best practices;

· Allocates resources and leadership attention to protect sensitive research and data; and

· Promotes a culture of security across academic, research, and administrative environments.

· The statement should also describe the institution’s existing or planned Insider Threat Program (ITP) in accordance with NISPOM requirements. The response should include:

· Policies and procedures to detect, deter, and mitigate insider threats.

· Training programs for faculty, staff, and students on recognizing and reporting insider threats.

· Mechanisms for monitoring and responding to suspicious activities within secure facilities and networks.

The statement should also highlight any existing capabilities, certifications, initiatives, or experience, including classified system development, accreditation, and administration experience, that demonstrates readiness to manage an incubator program described in Section 1071.

4. Statement signed by the actual or planned Facility Security Officer (FSO) or the faculty member who is or would be responsible for hiring and overseeing FSO function, if selected, affirming the institution’s commitment to meeting DoW security requirements for the protection of classified and controlled unclassified information. The statement should describe how the institution would:

· Establish and maintain a NISPOM-compliant security program;

· Support the establishment and maintenance of NISPOM-compliant security programs of incubator partners;

· Ensure oversight, training, and compliance across all participating departments, laboratories, and affiliated entities;

· Coordinate effectively with DoW security stakeholders to maintain compliance and address emerging requirements;

· Establish and maintain the FSO function with sufficient authority, support, and organizational placement to effectively implement and enforce security requirements; and

· Provide sufficient resources (including staffing, funding, and leadership support) to sustain compliance with NISPOM, Intelligence Community Directives (ICD), and DoW security requirement.

The statement should also identify the current and planned security structure and describe relevant experience managing classified or controlled research environments.

5. Statement signed by the Chief Legal Officer, Facility Security Officer (FSO), or equivalent senior official addressing the following:

· FOCI Disclosure:

· Disclose any foreign ownership, control, or influence over the institution or its affiliates, including:

· Foreign entities with ownership stakes in the institution.

· Foreign nationals or entities with significant decision-making authority or influence over institutional governance, operations, or research activities.

· Any foreign funding, partnerships, or agreements that could impact the institution’s ability to comply with U.S. national security requirements.

· FOCI Mitigation Plan:

· Describe measures in place or planned to mitigate FOCI risks, including:

· Governance structures to ensure independence from foreign influence.

· Policies and procedures to protect classified and controlled unclassified information (CUI) from unauthorized access.

· Compliance with the National Industrial Security Program Operating Manual (NISPOM) and other applicable security standards.

· FOCI Risk Assessment:

· Provide a risk assessment identifying potential vulnerabilities related to FOCI and the institution’s strategy to address them.

· Commitment to Compliance:

· Affirm the institution’s commitment to maintaining compliance with all Department of War (DoW) security requirements, including the mitigation of FOCI risks, to ensure the protection of classified and controlled unclassified information.

· Disclosure of any potential conflicts of interest (COI) that could impact the institution’s ability to participate in the incubator program. This includes:

· Financial relationships with foreign entities or governments.

· Dual-use research activities that could raise national security concerns.

· Any affiliations or partnerships that may present ethical or security risks.

Section F – Geographic and Strategic Considerations This section refers to the location of current or potential secure facilities. If the secure facility is not or would not be located on the main campus of your institution, note the location.

1. State and city.

1. Whether located in EPSCoR-eligible state.

1. Distance to major DoW installations, defense industrial base hubs, national labs, or other strategic national security resources.

1. Unique regional advantages.

Section G – Economic Viability and Sustainability

1. Proposed operating model, including:

0. Governance

0. Access control

0. Multi-tenant subscription or fee-for-use structure (detail how operating expenses will be spread across DoW, industry, and academic users)

1. 10-year pro forma business case including:

1. Capital expenditures

1. Operating costs

1. Revenue sources

1. Cost-sharing assumptions:

2. Minimum percentage of institutional cost-sharing required for capital and operating expenses.

2. Examples of acceptable cost-sharing sources (e.g., state funding, private-sector contributions, institutional funds).

2. Provide letters of commitment from cost-sharing partners.

1. Risk assessment and mitigation strategy.

1. Long-term sustainment strategy, if federal support declines.

Section H – Institutional Commitment and Co-Investment

1. Executive-level commitment statement signed by the President or Chancellor.

1. Proposed financial contribution:

1. Capital cost share (percentage and dollar amount)

1. Annual operating cost share (percentage and dollar amount)

1. Duration of institutional financial commitment

1. Description of any State, local, Tribal, or private-sector co-investment commitments.

1. Identification of any economic development incentives or legislative support secured or in progress.

Section I – Secure Facility Capability

1. If a specific facility or site has been identified, provide:

0. Building name and address.

0. Ownership status (university-owned, leased, public-private partnership, etc.).

0. Total square footage of proposed secure footprint at each classification level.

0. Floor plans (if available).

0. Current construction status and timeline

1. If no space has yet been identified, explain site selection criteria and anticipated timeline to designate a site.

1. Institutions should acknowledge and affirm understanding that participation in a potential incubator program would require:

· At minimum, space capable of supporting collateral-level classified work; and

· ICD 705-compliant space within the same facility; and

· Secure network infrastructure capable of supporting classified computing environments in accordance with applicable DoW and Intelligence Community standards.

1. Institutions shall confirm whether:

· They understand ICD 705 construction and accreditation requirements.

· They have prior experience constructing or operating ICD 705-compliant spaces.

· They have identified qualified security and construction professionals familiar with ICD 705 standards.

1. Preliminary cost estimates including ICD 705-compliant construction, collateral classified space construction, planned secure IT infrastructure, and TEMPEST or other specialized requirements, including:

· Basis of estimate (ROM, contractor quote, architect study, prior project benchmark, etc.).

· Identification of estimating entity (internal facilities office, cleared contractor, third-party firm).

· Assumptions used in the estimate.

· Contingency percentage included.

· Cost share breakdown (federal vs. institutional vs. other sources).

· Estimated annual sustainment cost.

If available, attach contractor quotes, engineering studies, or feasibility analyses. For institutions without prior SCIF experience, state how you derived this estimate (e.g., consultations with cleared architectural firms, benchmarking against partner universities, etc.)

Evaluation Emphasis While this is not a competition, the Department will assess responses based on:

· Magnitude and credibility of co-investment

· Demonstrated institutional commitment

· Alignment with defense technology priorities

· Readiness to operate secure facilities

· Workforce expansion potential

· Regional strategic value

· Business model viability

· FOCI risk mitigation

· Cybersecurity readiness

· Insider threat program Institutions unable to demonstrate significant financial co-investment and long-term sustainment planning are unlikely to be recommended for implementation planning.

Submission Requirements

· Format: Submissions must be formatted in standard 12-point font.

· Page Limit: The core narrative is limited to 15 pages.

· Appendices: The following items are excluded from the 15-page limit to encourage thoroughness without penalizing narrative space:

· Appendix A: Signed Executive Commitment Statements (Chief Legal Officer, CIO/CISO, President/Chancellor).

· Appendix B: 10-Year Pro Forma Financial Spreadsheet (Section G.2) – Excel or tabular format preferred.

· Appendix C: Facility Artifacts (Floor plans, architect studies, construction ROM quotes).

· Appendix D: Existing Security Policy summaries (e.g., TCPs, ITPs, Export Control).

· Deadline: Responses must be submitted no later than 120 days from the date of posting.

Note to Institutions: The Department is seeking realistic assessments. If your institution does not currently hold a Facility Clearance (FCL) or operate a SCIF, you are strongly encouraged to respond; however, your response must demonstrate a well-researched understanding of the timelines, bureaucratic requirements, and costs associated with achieving ICD 705 and NISPOM compliance.