Sources Sought - SCARS 29 Oct 2026 UNCLASS.pdf

UNCLASSIFIED

Page i

Sources Sought / Request For Information

Simulator Common Architecture Requirements and Standards (SCARS) 29 October 2026

Prepared By:

Air Force Lifecycle Management Center, PAE Training Directorate (AFLCMC/WN)

Advanced Training Capabilities Division (AFLCMC/WNR) 1895 5th Street, Building 46

Wright-Patterson AFB OH 45433

Page ii

UNCLASSIFIED

Table of Contents

1. REQUEST FOR INFORMATION (RFI) FOR PLANNING PURPOSES

2. PROGRAM REQUIREMENTS

2.1 Program Name

2.1.1 Program Description

2.1.2 Capability Required

2.2 Capability Assessment/RFI Response

2.3 General Information

2.5 Capability Information

2.5.1 SCARS Capability Information

UNCLASSIFIED UNCLASSIFIED

1. REQUEST FOR INFORMATION (RFI) FOR PLANNING PURPOSES

The Government is issuing this Sources Sought Synopsis (SSS)/Request For Information (RFI) solely for information and planning purposes and may consider responses to determine the acquisition strategy for a prospective contract. This is not a request for quote, request for proposal, or an invitation to bid, nor is this to be construed as a commitment by the Government to issue a solicitation or ultimately award a contract, nor does it restrict the Government to a particular acquisition approach. The Government will not reimburse or pay for any information submitted in response to this SSS/RFI or any follow-up information requests. Please be advised that all submissions become Government property and will not be returned. All costs associated with responding to this RFI will be solely at the responding party’s expense. Responses and/or questions related to this SSS/RFI must NOT contain classified information. The Contractor is responsible for identifying any elements of their response that contain proprietary information.

Not responding to this SSS/RFI does not preclude participation in any future RFP.

This SSS/RFI is gathering information for planning purposes to create the solicitation.

Responses to this notice are not offers and cannot be accepted by the Government to form a binding contract.

The Government does not intend to award a contract based on this SSS/RFI or to otherwise pay for the information solicited except as an allowable cost under other contracts as provided in RFO subsection 31.205-18, Bid and Proposal costs, of the FAR. Companies responding to this SSS/RFI are advised that participation does not ensure involvement in future solicitations or contract awards. The Government will not reimburse any company or individual for any expenses associated with preparation or participation in this RFI.

The acquisition strategy has not yet been determined. The SSS/RFI results will assist the Air Force in determining whether these requirements will be unrestricted competition or a small business set-aside award. The Government is assessing the capability of companies that may possess the expertise to competently and competitively respond to the following requirements for the Simulator Common Architecture Requirements and Standards (SCARS) Program to provide:

• Standards

• Experience Integrating with Simulators

• SOC (Security Operation Center) management

• Cyber compliance at multiple security levels Although “proposal” and “offeror” are used in this RFI, your response will be treated as information only. It shall not be used as a proposal.

2. PROGRAM REQUIREMENTS

2.1 Program Name

Simulator Common Architecture Requirements and Standards (SCARS)

2.1.1 Program Description

Simulator Common Architecture Requirements and Standards (SCARS) is a United States Air Force (USAF) sustainment initiative designed to incrementally establish a Modular Open Systems Approach (MOSA) across the Air Force simulator enterprise. The SCARS initiative leverages common applications, supports efficient and rapid updates to capabilities, evolves with cybersecurity threats and controls, and minimizes life cycle costs. These goals are achieved by developing a secure and scalable Simulator Common Architecture (SCA) based on open standards, modular design, and the extensive use of Commercial Off-the-Shelf (COTS) products.

The SCARS On-Premise Equipment (OPE) physically implements this architecture, with standardized local hardware and software fielded directly alongside training systems globally. By integrating directly with local simulators, the OPE utilizes a secure wide-area network (WAN) connectivity to the centralized SCARS Security Operations Center (SOC) near Wright-Patterson AFB. This secure pipeline enables the centralized SOC to perform remote vulnerability scanning, patch deployment, and virus updates. It also enables training system access to a common enterprise library of reusable software applications and data. OPE may be utilized to host simulator software in virtual machines.

2.1.2 Capability Required

The contractor must possess the capability to perform the following core functions:

• Security Operations Center (SOC) Operations: Operate, maintain, and staff a 24/7/365 SOC facility. Provide remote management of OPE, continuous monitoring of cyber security controls, incident handling, and tiered help desk support compliant with DoDM

8530.01. Define and execute remote SCARS events (vulnerability scanning, OS patching, baseline recovery).

• Remote Assessment & Authorization (A&A): Coordinate, conduct, and analyze remote vulnerability scans utilizing USCYBERCOM-approved tools (e.g., ACAS); coordinate credentialed scanning with simulator contractors; remediate findings within the SCA boundary; and maintain real-time status in eMASS and official AO reporting conduits.

• Software Patching & Baseline Integrity: Obtain, validate, test, and distribute monthly operating system patches, antivirus definitions, and quarterly security technical implementation guide (STIG) compliance updates across disparate simulator baselines.

• SCARS Library: Maintain multi-classification software and data repositories.

• Edge Virtualization & Modern Deployment on OPE: Assist remote site personnel with virtual machine provisioning, resource optimization, and software delivery utilizing Infrastructure-as-Code (IaC), containerized runtimes, and automated deployment pipelines.

• Network Integration & Management: Coordinate and troubleshoot dedicated Wide Area Network (WAN) connections, boundary protections, encryption devices, and circuit provisioning through DISA and host base communications squadrons.

• Model-Based Systems Engineering (MBSE): Develop, maintain, and deliver comprehensive system architecture models utilizing SysML in standard formats (e.g., .mdzip, HTML) compliant with DoDI 5000.88, DoDI 5000.97, and the WNR MBSE Modeling Guide.

• Governance of Architecture Standards: Serve as technical secretariat for the Government-led SECB; develop draft standards; facilitate working groups; and maintain automated Standards Compliance Tools (SCTs) for third-party verification.

• Enterprise Logistics & Fielding: Conduct site surveys, installation, integration, testing, and acceptance for 30 to 50 OPE units per year globally. Certify continuous Financial improvement and Audit Remediation (FIAR) compliance across all product support functions by providing full lifecycle support; including spares and technical refresh forecasting, inventory tracking in the Defense Property Accountability System (DPAS) to maintain Audit standards, Packaging, Handling, Storage, and Transportation (PHS&T), Item Unique Identification (IUID) registry management, and Diminishing Manufacturing Sources and Material Shortages (DMSMS) mitigation and management.

• Data Requirements: Deliver all data in accordance with the Contract Data Requirements List (CDRL) and at the times and frequency specified in the individual DD Forms 1423.

• Associate Contractor Agreements (ACAs): Establish and maintain Associate Contractor Agreements with the contractors that sustain training systems and wide area networks utilized by training systems.

• Security Requirements: Possess the corporate infrastructure necessary to obtain, manage, and maintain security clearances and accesses for personnel at scale.

Possess the corporate infrastructure necessary to obtain, manage, and maintain current training and certifications required by DoDM 8140.03 for an enterprise workforce.

Contract Specifications The Government projects a follow-on contract award in CY 2030, with an anticipated transition period of up to six (6) months leading to full operational performance in CY 2031. The anticipated structure includes a 4-year base period with six 1-year option periods and an optional 6-month extension of services (RFO 52.217-8 Option to Extend Services). All projected dates and contract structures are notional and subject to change based on market research and acquisition strategy approval. The Government anticipates the use of:

• Firm Fixed Price (FFP) Contract Line-Item Numbers (CLINs): Services

• Cost Reimbursable CLINs: Travel and studies/analysis tasks.

• Other: CLIN may be of any type authorized e.g., FFP, CPFF, CR, Fixed-Price Incentive Firm Target (FPIF), etc.

2.2 Capability Assessment/RFI Response

The Government is assessing the Small Business Pool to determine the Government’s ability to set this acquisition aside for the Small Business. The results of this assessment will allow the Government to make a determination as to whether these efforts will be set aside for Small Business or full and open. Respondents are encouraged to address the capability areas relevant to their organization.

Responses may address all or only portions of the anticipated requirement and may describe capabilities performed independently or through proposed teaming arrangements, joint ventures, mentor-protégé arrangements, or subcontracting relationships..

If there is demonstrated interest and capability sufficiently identified among small business contractors, then a Small Business Set-Aside will be considered. A key factor in determining if an acquisition will be a Small Business Set-Aside is that two or more potential small business prime contractors must be capable of performing at least 50% of the effort

2.3 General Information

In your response, please provide the following general information for your company/institution and for any teaming partners:

• If subcontracts or teaming are anticipated to be used, provide a reasonable expectation for both small and other than small business utilization as a percent of total task order value. Provide specific details on how your company will comply with RFO clause 52.219-14 LIMITATIONS ON SUBCONTRACTING (FEB 2023) (DEVIATION 2021-O0008). Delineate the small business utilization percentage and provide rationale for the recommended percentage. Teaming and/or subcontracting arrangements should be clearly stated, including the anticipated roles and responsibilities of team members. Relevant prior teaming experience may be provided, if available, but is not required to submit a response.

• What data do you require from the Government in order to assemble a proposal for this effort?

Direct and concise responses are preferred. Marketing material is considered an insufficient response to this Capability Assessment/RFI. Please use the following file-naming convention: <<Company Name>> <<Program Name>> RFI Response. Limit responses to electronic submissions no more than 12 pages 8.5”x11” pages for all programs in total, using Word or PDF format. This includes all graphs and charts. A point of contact that can represent your company should be identified to answer further Government inquiries and provide explanations that might be needed regarding the information provided. Respondents should indicate which portions, if any, of their response are proprietary and should mark them accordingly. All information received shall be safeguarded from unauthorized disclosure.

Formal responses should be submitted via electronic submission through SAM.gov .

Further questions may be e-mailed to anne.torian@us.af.mil and daniel.douglass.2@us.af.mil.

Responses are due NLT 3:00 PM Dayton, Ohio time, 10 December 2026. The Government may converse with respondents regarding this RFI. Such conversations are intended to clarify potential capability to perform the requirements.

A responder may request clarification in writing from the Contracting Officer for any aspect of this RFI that is unclear. Any requests for clarification must be received no later than seven (7) business days prior to the closure of the RFI.

2.4 Respondent Information

Each company response should include the following information:

Company/Institute name:

Address:

Point of Contact:

CAGE Code:

DUNS Number:

Phone Number:

E-mail Address:

Web page URL:

2.4.1. All interested contractors must be registered in the System for Award Management

(SAM) database to be awarded a DoD contract. The North American Industry Classification System (NAICS) Code for this requirement is 541511 ($34,000,000.00 revenue). Based on the NAICS Code, state whether your company qualifies as a:

a. Small Business (Yes/No):

b. Women-Owned Small Business (Yes/No):

c. Economically Disadvantaged Women Owned Small Business (Yes/No):

d. 8(a) Certified (Yes/No):

(If yes, SBA Certification Date):

SBA Graduation Date:

e. HUB Zone Certified (Yes/No):

f. Veteran Owned Small Business (Yes/No):

g. Service-Disabled Veteran Owned Small Business (Yes/No):

h. Statement as to whether your company is domestically or foreign owned (if foreign owned, please indicate country of ownership).

2.5 Capability Information

In response to this RFI, please provide the following cross-program and training system specific capability information for your company and for any teaming partners. Relevant experience does not need to be identical in size, scope, or complexity to be considered responsive. Respondents should describe their current capability, relevant comparable experience, and/or proposed approach for the requirement areas addressed, including any planned scaling, transition, or teaming arrangements. In the response, please clearly specify if a response is based on experience or capability.

2.5.1 SCARS Capability Information

In response to this Capability Assessment/RFI, please provide the following capability information specific to SCARS requirements.

Category 1: Program Management, Personnel, & Transition

1. Small Business Subcontracting Limitations:

As the proposed effort is considered by the Government to be one for Services, small business offerors will be required to comply with subparagraph (c)(1) of FAR 52.219-14 LIMITATIONS ON SUBCONTRACTING (FEB 2023) (DEVIATION 2021-O0008), which requires that “[a]t least 50 percent of the cost of contract performance incurred for personnel shall be expended for employees of the concern.” Please describe in detail how you will satisfy the requirements of RFO 52.219-14(c)(2) for this effort.

2. Workforce Mobilization, Clearances, & Certifications:

Describe your company’s experience or proposed approach to meeting rapid transition timelines at the start of performance for multiple personnel requiring both security clearances and technical certifications compliant with DoD 8570.01-M and/or DoD 8140.

Category 2: Enterprise Systems, Cloud, & Remote Network Management

3. Distributed Enterprise & Active Directory Management:

Describe your company’s experience or proposed approach with remotely managing up to 2,000 geographically separated edge-cloud and classified systems from a central location. Your response should address managing Active Directory across multiple security levels while meeting Risk Management Framework (RMF) requirements.

4. Real-Time Virtual Machine Optimization:

Describe your company’s experience or proposed approach with remotely supporting users with the provisioning, configuration, and performance optimization of virtual machines for simulators with real-time response requirements.

Category 3: Cybersecurity, Information Assurance, & Compliance (RMF/ATO)

5. ISSM Support for Classified Simulators:

Describe your company’s experience or proposed approach providing Information System Security Manager (ISSM) services for classified training simulators.

6. Vulnerability Scanning & eMASS Administration:

Describe your company’s experience or proposed approach conducting and analyzing Assured Compliance Assessment Solution (ACAS) scans, identifying and tracking vulnerabilities, and updating corresponding Authorization to Operate (ATO) information in the Enterprise Mission Assurance Support Service (eMASS).

7. DoDM 8530.01 Defense-in-Depth Compliance:

Describe your company’s experience or proposed approach providing cybersecurity service provider functions equivalent or comparable to those required by DoDM 8530.01. Include the scope of support provided and the operational environments supported.

8. Compliance with Security Requirements Baseline:

Describe your company’s experience or proposed approach complying with program-specific physical, facility, personnel, and cybersecurity requirements identified in Section 2.1 (Security Requirements).

9. Vulnerability Remediation vs. Mission Availability:

Describe your company’s experience or proposed approach to prioritizing and remediating vulnerabilities in operationally sensitive systems where patching, downtime, or reconfiguration may affect simulator training availability or mission performance.

Category 4: Systems Engineering, Architecture, & GFE Integration

10. GFE Fielding, Testing, & Capacity Scaling:

Describe your company’s experience, capacity, and/or proposed approach to fielding, testing, and integrating network/server Government Furnished Equipment (GFE) with training systems across multiple classification levels at CONUS and OCONUS locations. Address your capacity and approach to scaling or ramping operations to meet a throughput of up to 30 GFE systems per year.

11. GFE Long-Term Sustainment & Operations:

Describe your experience or proposed approach sustaining network/server GFE integrated with training systems across multiple classification levels at CONUS and OCONUS locations. Your response should address support for software license management, hardware maintenance, sustainment operations, maintaining ATO and cybersecurity controls, Communications Security (COMSEC), and Packaging, Handling, Storage, and Transportation (PHS&T) for OCONUS locations.

12. Digital Materiel Management:

Describe your company’s experience or proposed approach providing systems engineering, configuration management, and logistics support in accordance with DoDI 5000.88 (Engineering of Defense Systems) and DoDI 5000.97 (Digital Engineering).

13. Model-Based Systems Engineering (MBSE) & SysML:

Describe your company’s experience or proposed approach with Model-Based Systems Engineering (MBSE). Specifically address your current methodology and toolsets for building, validating, and sustaining SysML models across the system lifecycle.

14. Architecture Governance & Standards Compliance:

Describe your company’s experience or proposed approach with managing governance of

Government system architecture standards, developing new standards baselines, managing testing processes for assessing third-party compliance, and tracking compliance of external vendor systems to mandated standards.

Category 5: Lifecycle Sustainment, Logistics, & Hardware Support

15. Enterprise Spares & High-Downtime Minimization:

Describe your company’s experience or proposed approach to spare parts management, repair cycles, supply chain resilience, and minimization of downtime for critical training system components across an enterprise of up to 2,000 systems fielded at geographically separated locations both CONUS and OCONUS.