SSD_RFI_QA_2025-12-19.pdf

# Question FAA Response

Will the FAA provide a one-week extension to the submission deadline for the RFI? The FAA does not intend on granting an extension to this RFI.

2 Can you identify the incumbent for SSD-RFI-1?

The incumbent currently performing the Software Solution Delivery (SSD) Contract #DTFACT-17-D-00007 is Karsun Solutions.

Would you be able to provide the list of applications and databases encompassed within this Software Solution Delivery (SSD) acquisition?

Understanding the specific systems in scope is essential, as the modernization strategies and solutions may vary considerably depending on the underlying legacy technologies.

The FAA will not be providing a list of applications and databases as part of this RFI. Such information may be provided in later phases, but is not necessary for a response to the RFI.

How does the FAA Modernization work discussed in the SSD RFI differ or relate to the contract recently awarded to Peraton?

The award to Peraton is for the FAA's Brand New Air Traffic Control System (BNATCS) which is entirely distinct from the scope outlined in this RFI.

Is the existing ecosystem built around a specific technology stack? Is FAA looking to keep this and modernize it or is this RFI open to developing greenfield solutions?

The current ecosystem is not built around a specific technology stack we are open to either modernizing existing technology and/or developing entirely new solutions.

Will the FAA provide clarification on whether the final vehicle will be a FAR-based contract or OTA?

The final vehicle type (e.g., IDIQ contract, OTA, etc.) has not yet been determined. Also, the FAA is subject to the procurement policies set forth in the Acquisition Management System (AMS) and not the FAR. AMS Policy and Guidance are available at https://fast.faa.gov/PPG_Procurement.cfm.

Are vendors who were aligned to the original SSD opportunity precluded from participating in this new ChBA initiative? No.

Within the inventory of application and databases of interest, has rationalization been done? If so, can any results of rationalization be provided?

Application rationalization has been performed and will continue to be maintained as systems and mission needs evolve. Such information may be provided in later phases but is not nesssary for a response to the RFI.

If rationalization has been done, how does FAA prioritize applications for rationalization (by cost, usage, technical debt, or risk)?

Rational has been performed and prioritization varies depending upon the mission/function the application supports.

Can FAA provide an inventory list and description of the applications and databases that would be part of the application and modernization effort? See answer to question #3.

11 Is a cover page(s) included within the RFI respond page count limits?

The cover page is not included in the page limit. The RFI indicates that responses should not exceed 15 pages. Responses with page counts that exceed this recommended limit may not be reviewed in their entirety.

Does the FAA have an anticipated high level goal in terms of the number of applications and/or databases to carry forward or consolidate to? Currently, there is no set goal for the number of applications or databases.

13 Does the FAA has an anticipated goal or timeframe for a contract award? The FAA is targetting award in FY26.

Can the FAA provide a description of the existing FAA Horizon DevOps Toolchain composition?

The FAA is seeking recommendations and not limiting input to current standard, tools or practices.

Can the FAA provide a description of the existing FAA Tyrion Kubernetes container?

The FAA is seeking recommendations and not limiting input to current standards, tools or practices.

Are there any systems or data domains explicitly out of scope (e.g., NAS core systems) for modernization? The precise scope will be fully defined at a later stage in the acquisition.

Innovative Solutions for FAA Application and Database Modernization RFI Q&A - December 19, 2025

Q&A - December 19, 2025

Are there FAA standards for API-driven architectures, microservices, or data fabric approaches that FAA wants to carry forward?

The FAA is seeking recommendations and not limiting input to current standards or practices.

What role does FAA envision for its internal teams during modernization—execution, oversight, or co-development? This does not pertain to the request for information.

How important is knowledge transfer and training for FAA staff in the proposed solution? This does not pertain to the request for information.

Does FAA expect vendors to provide a long-term sustainment model or transition to FAA teams?

The FAA is seeking recommendations and not limiting input to current standards or practices.

Section I. Purpose states “This new ChBA will supersede and entirely replace the Software Solution Delivery (SSD) acquisition which was expected to be issued and awarded this fiscal year.” Question – Please provide additional details regarding the SSD acquisition.

The FAA was conducting a follow-on procurement to the Software Solution Delivery (SSD) Contract #DTFACT-17-D-00007 under an FAA enterprise-wide contract vehicle which was cancelled on December 4, 2025 and replaced by this ChBA.

What is classified as the mission support portfolio, which are the specific applications and databases in completed for modernization; this information is required to ensure that a RFI response addresses the goal of the RFI? See answer to question #3.

The RFI does not expressly state if cloud will be acquired through the resulting agreements; it read like services only. Please advise if this is correct. We envision this to be a services only contract.

Section V, item 8. Risks and Lessons Learned states “What options for bridge or pilot contracts do you recommend to facilitate smooth transition from challenge demonstration to full-scale deployment and long-term sustainment” - Question - What is anticipated being sourced through the bridge or pilot contract verses the contract contemplated in the RFI? The FAA is seeking recommendations and open to acquisitions models.

How does the FAA SAVES program and the FAA Request for Quote (RFQ) seeking to establish a single award GSA MAS Blanket Purchasing Agreement (BPA) for a five year term fit with this RFI?

The SAVES program is for the acquisition of IT hardware and software, and is completely separate from the scope of services of this ChBA.

To allow for more thorough responses, will the FAA consider increasing the page limitation? See answer to question #11.

Can the FAA clarify whether the initial Challenge Based Acquisition is intended to focus on a representative subset of applications and databases, or whether industry responses should assume enterprise-wide applicability across the full FAA mission support portfolio from the outset?

The current scope is across the 200 applications and 3,000 databases referenced in the RFI.

Can the FAA clarify whether legacy applications are generally standalone or whether they exhibit significant interdependence and cross-system orchestration that should be assumed when recommending phased modernization approaches? A combination of both standalone and cross-system interdependencies.

Should industry assume that legacy and modernized systems will coexist for extended periods, or does the FAA anticipate more aggressive decommissioning following completion of modernization waves? This has not been determined yet.

Does the FAA intend to define or provide representative application and database archetypes (for example, custom-built, COTS-based, data-intensive, or integration-heavy systems) to anchor industry recommendations and challenge scenarios?

The FAA will not be providing applications and database archetypes as part of this RFI. Such information may be provided in later phases, but is not necessary for a response to the RFI.

Q&A - December 19, 2025

Does the FAA maintain, or plan to establish formal prioritization criteria for the 200 applications (such as mission criticality, user impact, security risk, technical debt, or sustainment cost) that industry should assume when recommending modernization sequencing and challenge design?

The FAA is seeking recommendations that may include application rationalization.

Can the FAA clarify whether the 3,000 databases are generally tightly coupled to individual applications, or whether significant shared and cross-application data dependencies should be assumed when recommending data fabric or data mesh approaches?

The 3,000 databases is a combination of individual applications and cross applications data dependencies.

Will the FAA support vendors by characterizing the legacy data environment at a high level, including data volumes, schema stability, data quality variability, and regulatory or retention constraints, to support realistic modernization and migration recommendations?

The FAA will not be providing that information as part of the RFI. Such information may be provided in later phases.

Should industry assume that modernization efforts require full historical data migration, partial migration with archival access, or forward-only transition models, and should legacy system coexistence be considered a standard assumption during phased modernization? This could vary dependent upon application.

Does the FAA anticipate identifying systems of record versus systems of engagement across applications and databases, or should industry assume that authoritative data ownership and governance will be resolved during modernization execution? This should be included as part of modernization.

Does the FAA anticipate providing government-furnished legacy code, schemas, APIs, or documentation for challenge participation, and if so, at what level of completeness and fidelity? This is to be determined.

For challenge design and evaluation purposes, does the FAA plan to provide indicative user population characteristics, including internal versus external users, role types, concurrency expectations, or peak usage patterns, or should respondents assume generic, scalable user models? This is to be determined.

What security, privacy, and compliance baselines does the FAA expect to apply during the challenge phase itself, particularly with respect to FAA AMS requirements, cybersecurity controls, identity management, and audit logging, as distinct from post-challenge implementation? This is to be determined.

Are there existing or planned FAA policy constraints or guardrails governing AI-assisted development, automation, or decision-support capabilities that industry should assume when recommending AI-enabled modernization approaches?

The FAA is seeking recommendations and not limiting input to current standards or practices.

Does the FAA expect AI capability to be demonstrated primarily through development-centric use cases, such as legacy code analysis, migration support, or automated testing, or through operational use cases, such as workflow optimization, anomaly detection, or predictive insights? This is to be determined.

Q&A - December 19, 2025

Among innovation, automation or ML capability, interoperability, security compliance, scalability, and cost effectiveness, does the FAA anticipate any priority emphasis or weighting during multi-phase challenge evaluations? The FAA is seeking recommendations, see section 6.

Does the FAA anticipate that successful challenge participants may transition directly to pilot, bridge, or production modernization efforts, or should industry assume that a separate competitive action will govern post-challenge deployment?

The exact strategy has not been determined at this time. The FAA will utilize feedback from the RFI to finalize the acquisition strategy.

Does the FAA envision that the fixed price and or OTA construct applies only to the challenge phase, or extending into modernization, optimization, and sustainment phases, and is the FAA open to hybrid pricing models across lifecycle stages?

The FAA is open to all recommendations at this stage, including hybrid pricing models across lifecycle stages.

What is the estimated number of distinct users (including Developers, DevOps Engineers, Architects, and Security staff) who will actively utilize the platform for modernization tasks?

The FAA will not be providing that information as part of the RFI. Such information may be provided in later phases.

Can the FAA provide a high-level breakdown of the database engines in use for the 3,000 instances (e.g., Oracle, SQL Server, PostgreSQL, Mainframe/DB2), and are these databases primarily tightly coupled monoliths or already segmented?

The FAA will not be providing that information as part of the RFI. Such information may be provided in later phases.

Does the modernization scope include deployment to air-gapped or disconnected environments, and if so, does the FAA require a solution that offers a full-feature 'Self-Managed' version capable of running entirely within the FAA's secure boundary?

The FAA is seeking recommendations and not limiting input to current standards or practices.

For the Challenge phase, will the FAA provide a Government Furnished Equipment (GFE) environment with pre-loaded legacy applications, or are vendors expected to bring their own representative legacy payloads?

Would it be acceptable to use our SaaS platform with dummy data?

The FAA is seeking recommendations and not limiting input to current standards or practices.

What incumbent CI/CD and orchestration tools are currently in use (e.g., Jenkins, GitLab), and is the FAA seeking to integrate with these tools or replace them entirely?

The FAA is seeking recommendations and not limiting input to current standards or practices.

Beyond standard FedRAMP requirements, are there specific Continuous Authority to Operate (cATO) objectives or automated compliance artifact generation (e.g., OSCAL) that this initiative seeks to achieve?

The FAA is seeking recommendations and not limiting input to current standards or practices.