(U) FA8600-23-S-C056-0008 - CSO Call 8 - PROJECT SMILEY.pdf

UNCLASSIFIED

CSO CALL 8- PROJECT SMILEY

OVERVIEW

This Commercial Solutions Opening (CSO) Call solicitation is issued in accordance with Defense Federal Acquisition Regulation Supplement (DFARS) Section 212.70

NAICS Code and associated description: 518210

Federal Agency Name and Contracting Officer: AFLCMC, Marina Schemmel

Commercial Solutions Opening Title: This is a combined synopsis/solicitation for the AFLCMC Data Operalion CSO Call 8 titled "PROJECT SMELEY."

Commercial Solutions Opening Number: FA8600-23-S-0056-0008

Commercial Solutions Opening Type: This is the initial announcement of Call 8. This will be a One-Step Closed Call.

One Step: PROPOSAL DUE DATE AND TIME: Proposals will be accepted until Tuesday, 1 July 2025 at 0900 ET. Proposals may be submitted at any time during this period. Proposals received after the specified date and time will be considered late in accordance with FAR 52.212-1(f). Late proposals may be accepted by the Contracting Officer if it is determined to be in the Government's best interest.

Submission POCs: Proposals must be submitted via email to the following Points of Contact

(POC):

Contracting Officer: Ms. Marina Schemmel Email: AFLCMC.AFLCMC.DataOpsCSO@us.af.mil

Contract Specialist: Capt. Raymond Cordova Email: AFLCMC.AFLCMC.DataOpsCSO@us.af.mil

FULL TEXT

CSO CALL 8- PROJECT SMILEY

OVERVIEW

This Commercial Services Opening (CSO) Call is intended to be a streamlined solicitation to allow for the establishment of modem Data Operations (DataOps) solutions supporting a variety of critical national security systems. Specifically, the Air Force Life Cycle Management Center (AFLCMC) requires a vendor to perform cyber assessments of industry vendors. Offerors are invited to submit technical proposals to develop and deliver a state-of-the-art commercial solution that addresses the technical and performance requirements as detailed in Attachment 1 —Statement of Objectives (SOO) — Project Smiley.

This AFLCMC project requires a vendor to have personnel who have at minimum Secret security clearances. To be eligible for contract award, vendors must be cleared to work, or have the ability to be cleared to work, in a classified environment at the time of proposal submission.

AFLCMC anticipates awarding a FAR Part 12 contract to one or more vendors. Vendors should review FAR clauses 52.2 12-4 and 52.2 12-5 for standard terms and conditions of a FAR Part 12 contract. AFLCMC is not obligated to make any awards as a result of this Call and all awards are explicitly subject to the availability of funds and successful negotiations.

The Government is not responsible for any monies expended by the vendor prior to the issuance of any awarded contract.

AFLCMC intends to follow the processes identified in the "AFLCMC Data Operations CSO" unless otherwise noted or annotated in this Call. AFLCMC reserves the right to modify the solicitation requirements of this CSO Call at its sole discretion.

DIGITAL INFRASTRUCTURE (DI) FOCUS AREAS

This Call is issued in support of the following Focus Areas:

5. Network Operations Center (NOC) / Security Operations Center (SOC) AFLCMC is seeking solutions to support, enable, and augment network administration and cybersecurity operations.

X. Cyber, Secure Processing Due to the sensitive nature of the USAF mission, the ability to leverage cyber secure processing, compliant with DoD standards for all impact levels is required.

Deliverables: The following includes the anticipated contract deliverables to be submitted by awarded vendors by the end of the Period of Performance (PoP):

i. The Contractor shall deliver contract kick-off presentation material.

ii. The Contractor shall deliver a report of findings for each vendor network owner undergoing a cyber assessment. For each confirmed finding, the Contractor shall provide mitigation strategies andlor guidance on vulnerability remediation for the identified vendor network owner.

CALL DESCRIPTION, INSTRUCTIONS TO OFFERORS, AND EVALUATION

CRITERIA

Overview: This call will be a One-Step Closed call. The proposal due date and time is Tuesday 1 July 2025 at 0900 ET. Proposals must be submitted to the following org box:

AFLCMC.AFLCMC.DataOpsCSO@us.af.mil.

Proposals may be submitted at any time prior to this due date and time. White Papers will not be accepted. Offerors are responsible for monitoring SAM.gov for any amendments to this Call that may have updated information. Proposals will be evaluated against the criteria detailed below in Evaluation Criteria.

All proposals must be UNCLASSIFIED. AFLCMC wifi not accept classified proposals under this Call.

CONTRACT DETAILS:

Contract Type: AFLCMC anticipates awarding a FAR Part 12 contract to one or more vendors. The awarded contract may be structured as an Indefinite Delivery Indefinite Quantity (IDIQ) contract with the ability to issue Firm Fixed Price (FFP) task orders for a period of five (5) years from the contract effective date.

PROPOSAL INSTRUCTIONS: Below is the required structure and required content for proposal submission for this Call. Offeror responses shall be submitted to Ms. Marina Schemmel, no later than 0900 ET on 1 July 2025, via email to AFLCMC.AFLCMC.DataOpsCSO@us.af.mil organization email.

Please submit files in either PDF, Word, Excel, or PowerPoint file type(s). The proposal submission must include, at minimum, the following five Parts:

Part 1 - Cover Page;

Part 2 - Technical Proposal;

Part 3 - Price Proposal;

Part 4- Statement of Work (SOW)

Note: Some file type(s) may get quarantined in the AFLCMC firewall. Offerors are encouraged to specify the number of attachments included in the proposal submission email.

AFLCMC will provide a confirmation of receipt for each timely proposal submission. Ifan Offeror does not receive an email confirming proposal receipt, they are encouraged to follow-up with the AFLCMC.AFLCMC.DataOpsCSO(us.afmi1 org box to ensure successful proposal transmission.

Mandatory Proposal Items: The following section provides a template for Parts 1- 4 of a complete proposal submission:

Part 1 — Cover Page:

The vendor's cover page must include the following information:

1. Vendor Name

2. Vendor Address

3. Vendor technical, programmatic, and contracts points of contact (PoCs)

4. List whether your organization qualifies as any of the following in accordance with FAR Part 19: Small Business (SB), Small Disadvantaged Business (SDB), Woman- Owned Small Business (WOSB), HUBZone Small Business, Veteran- Owned Business, Service-Disabled Veteran Owned Small Business (SDVOSB), Historically Black College or University (HBCU) and Minority Institution

5. CAGE code

6. Cognizant Security Office

i. Name

ii. Address

iii. Phone Number

7. Provide a list of general classification levels and additionally proscribed categories from the below options that your organization has utilized for past projects.

(UNCLASSIFIED / CUI / SECRET I SECRET SAR / TOP SECRET I TOP

SECRET SAR / TOP SECRET SCI) Note: Do not provide any classified information regarding past projects on your submission, to include contractlagreement numbers (PiIDs).

Part 2 - Technical Proposal:

The vendor shall include an executive summary in the technical proposal not to exceed (NTE) two pages.

The technical proposal shall provide a detailed technical response that addresses all the technical and contractor requirements as detailed in Attachment 1— Statement of Objectives - Project Smiley. The technical volume shall discuss all tasks to be performed, and if necessary, a brief description of each proposed labor category.

The technical proposal shall not exceed 10 pages. The total page count does not include the Cover Page in Part 1 or the Executive Summary. Any pages submitted in excess of the 10-page limit will not be considered or evaluated.

Part 3 - Price Pronosal

The price proposal must include pricing information sufficiently detailed for meaningful evaluation of the proposal. Since this Call will result in a FAR Part 12 commercial contract, the requirements of the Truth in Negotiations Act (TINA) are not applicable. For pricing purposes, vendors should assume a contract start date of approximately ninety (90) days after submission of the proposal.

The vendor shall include a Microsoft Excel spreadsheet with the price proposal detailing the proposed cost elements and overall price.

Part 4 - Statement of Work (SOW):

A SOW must be included with the full proposal. The SOW shall not exceed 5 pages in length and must be a separate and distinct document suitable for incorporation into the procurement instrument. Do not include proprietary data or markings in the SOW.

The proposed SOW shall accurately describe the work to be performed to meet the requirements in Attachment 1 — Statement of Objectives - Project Smiley.

EVALUATION CRITERIA

Proposal Evaluation Criteria: Proposals will be evaluated in accordance with the following evaluation criteria:

1. T- Technical:

Experience: Has the offeror demonstrated experience in the SOO areas?

Access: Is the offeror eligible for security access to AFLCMC programs, specifically two personnel with an active Secret clearance, at minimum, with at least one Special Access Program (SAP) read-in to facilitate a S//HVSACO conversation by contract kickoff?

Schedule: Is the offeror's proposed solution feasible to be delivered within the time constraints of the anticipated award?

2. P - Price: The proposed price will be evaluated for reasonableness.

No other criteria will be used.

Using the evaluation criteria, AFLCMC will select proposals for award that best meet the Government's needs. The selection of one or more sources for award will be based on the Government's evaluation and funding availability. NOTE: AFLCMC reserves the right to award and fund one or more, or no, contracts for all or part of the proposals received.

AFLCMC reserves the right to not award to a vendor who will be subject to a cyber assessment under this Call due to a potential organizational conflict of interest (OCI). The Government may incrementally fund any or all awards under this CSO Call. All awards are subject to the availability of funds.

Prior to award to a successful vendor, the Contracting Officer will make a determination regarding price reasonableness.

Debriefings: The Government will conduct written, post-award debriefings upon request only in accordance with 52.212-1(1) and will address the evaluation factors contained herein only. It will not include a comparison of submissions against a common statement of work (SOW) as the CSO provides no common statement of work that interested parties must respond to and instead represents opportunity for submission of a variety of innovative commercial items, technologies, andlor services that represent meaningful submissions of diverse scope and price.

GENERAL PROPOSAL INFORMATION

Proposal Content: Reference the below One-Step, Closed Call Process, for details on what to include in Proposal submissions.

Proprietary Information: Information constituting a trade secret, commercial or financial information, confidential personal information, or data affecting national security must be clearly marked. It shall be treated in confidence to the extent permitted by law. This restriction does not limit the Government's right to use information contained if it is obtained from another source without restriction. AFLCMC assumes no liability for disclosure or use of unmarked data and may use or disclose such data for any purpose. If a vendor is awarded a contract as a result of/or in connection with the submission ofproprietary data in the proposal, the Government shall have the right to duplicate, use or disclose the data to the extent provided in the resulting contract. Proposals containing data that is not to be disclosed to the public for any purpose or used by the Government except for evaluation purposes shall include the following sentences in accordance with FAR 52.2 15-1(e)(l) and (2) on the cover page:

"This proposal includes data that shall not be disclosed outside the Government and shall not be duplicated, used, or disclosed-in whole or in part - for any purpose other than to evaluate this proposal. If, however, a contract is awarded to this offeror as a result of- or in connection with - the submission of this data, the Government shall have the right to duplicate, use, or disclose the data to the extend provided in the resulting contract. This restriction does not limit the Government's right to use information contained in this data if it is obtained from another source without restriction. The data subject to this restriction are contained in sheets [insert numbers or other identflcation of sheets]."

Each restricted data sheet should be marked as follows:

Use or disclosure of-data contained on this sheet is subject to the restriction on the title page of this proposal.

Classified Proposals: Classified proposals WILL NOT be accepted under this Call.

Security: Offerors must possess all required personnel security clearances, facility clearances, and other infrastructure requirements necessary to perform any proposed classified work in accordance with a Contract Security Classification Specification (DD Form

254) without reliance on Government resources. Offerors must verify their Cognizant Security

Office information is current with the Defense Counterintelligence and Security Agency, DCSA (https://dcsa.mil).

If the vendor intends to perform classified work at their facility (or subcontractor or sub-awardee's facility), they will need to provide a Facility Accreditation Letter (FAL) for each facility to the Contracting Officer by no later than (NLT) contractlinstrument award.

Small Business: FAR-based contracts awarded pursuant to this CSO Call shall include FAR

52.2 19-8, Utilization of Small Business Concerns (FEB 2024). FAR-based contracts awarded pursuant to this CSO Call which meet FAR Subpart 19.7 criteria for small business subcontracting plans shall include FAR 52.2 19-9, Small Business Subcontracting Plan (SEP 2023).

OTHER INFORMATION

DFARS 252.239-7017 -NOTICE OF SUPPLY CHAIN RISK (DEC 2022):

(a) Definitions. "Supply chain risk," as used in this provision, means the risk that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert the design, integrity, manufacturing, production, distribution, installation, operation, or maintenance of a covered system so as to surveil, deny, disrupt, or otherwise degrade the function, use, or operation of such system (10 U.S.C. 3252).

Supplier Performance Risk System: In order to receive a DOD contract, every vendor will be required to perform a Basis NIST SP 800-171 DoD Assessment. Once the Basic NIST 800-17 1 DoD Assessment is complete, each vendor will need to follow the instructions contained within https://www.sprs.csd.disa.mil to enter the results in the SPRP on the PIEE website.

Telecommunications: All contracts awarded under this call will contain prohibitions on the use of certain telecommunications devices in accordance with DFARS 52.204-25.

Data Rights: All proposal submissions shall include data rights assertions, if applicable. This will be an essential element of each proposal submission. Special Licensing Agreements may be negotiated upon request. AFLCMC reserves the right to negotiate data rights as part of the Contracting process.

Export-Controlled Items: The awarded contract may be subject to Export Control (International Traffic in Arms (ITAR) 22 CFR 120-131, or Export Administration Regulations (EAR) 15 CFR 7 10-774). Only Offerors who are registered and certified with the Defense Logistics Services Center (DLSC) and have a legitimate business purpose may participate in this solicitation. Contact the DLSC, 74 Washington Avenue N., Battle Creek, Michigan 409 17-3084 (1-800- 352-3572) for further information on the certification process.

Offerors shall submit a current and active Certified DD Form 2345, Military Critical Technical Data Agreement, with their proposal. The form, instructions, and FAQs may be found at the United States/Canada Joint Certification Program website, http://www.dla.mil/HQ/lnformationOperations/Offers/Products/LogisticsApplications /JCP/DD2345Instructions.aspx. Approval of the DD Form 2345 will be verified if proposal is

Statement of Objectives

PROJECT SMILEY

Version 1.0

5 June 2025

1 OBJECTIVE

This Statement of Objectives (SOO) describes the technical requirements to be performed by the Contractor in support of Project Smiley. AFLCMC has a requirement for a vendor to conduct cyber assessments of industry in support of mission effectiveness.

2 BACKGROUND

The Contractor shall leverage its strong experience conducting cyber vulnerability assessments to meet the objectives in this SOW.

3 TECHNICAL REQUIREMENTS

3.1 The Contractor shall conduct nation state level adversarial penetration testing of

AFLCMC-identified development networks, not exceeding 30-days per engagement at various 3rd party industry vendor facilities.

3.2 The Contractor shall assess industry vendor Controlled Unclassified Information (CUT) networks. The Contractor shall provide feedback on discovered vulnerabilities with regards to the latest revision of National Institute of Standards and Technology (NIST) Special Publication 800-171.

3.3 The Contractor shall assess Joint Special Access Program Implementation Guide (JSIG) compliant networks.

3.4 The Contractor shall perform cyber assessments on industry vendor networks with a specific focus on evaluating the networks' security from nation-state actors with the goal to gain subversive network access, establish persistence, perform lateral movement and privilege escalation, and attempt data exfiltration from within the identified vendor network.

3.5 The Contractor shall deliver a report detailing actionable recommendations and remediation activities to improve the evaluated vendors' network security, technology, and culture postures.

3.6 The Contractor shall coordinate directly with industry vendors to schedule and perform cyber assessments, to include establishing a Non-Disclosure Agreement (NDA) between the Contractor and the vendor whose network is being assessed. The Contractor shall be able to perform at least four assessments in parallel.

4 PLACE OF PERFORMANCE

Primary places of performance shall be at Contractor facilities or designated industry vendor network sites.

5 REQUIRED EQUIPMENT/INFORMATION

The Contractor will be provided access to each industry vendor's development environment instance(s).

6 PROGRAM MANAGEMENT

The Contractor shall ensure the contract is executed within contract specifications, actively participate in virtual and in-person meetings, manage deliverables, and support technical and security activities. The Program Manager shall be the primary interface to the Government.

7 PROGRAM SECURITY

The Contractor must meet the requirements for Security detailed in the Call.

8 ANTICIPATED DELIVERABLES

The anticipated deliverables for this contract are contract kick-off presentation materials and reports of findings compiled at the completion of each industry vendor's cyber assessment. The report shall provide mitigation strategies andlor guidance on vulnerability remediation for each confirmed finding during the cyber assessment.