Industry Day Questions and Answers.pdf

Question Section Answer Final What is the Government’s approach to acquisition, and what factors could alter it? (e.g., market research results, protest risk) Acquisition & Competition This will be a task order request under Army CHESS ITES-3S

Will this be full & open or a set-aside (SBSA/WOSB/SDVOSB), and what participation goals apply? Acquisition & Competition This will be an unrestricted task order request under Army CHESS ITES- 3S. Both large and small businesses may submit proposals

Which contract vehicle will be used (IDIQ vs. single/multiple award), and why was that structure chosen? Acquisition & Competition This will be a single award order under Army CHESS. The requirement is well-known, un-ambiguous.

What contract type is anticipated (FFP/CPFF/T&M/hybrid), and under what conditions do CLIN types vary? Acquisition & Competition This will be a FFP order, providing performance based service in-line with

EO 14402

What is the expected timeline for Draft RFP, Final RFP, proposal due date, evaluation, and award? (include any planned Q&A windows) Acquisition & Competition Draft Timeilne is in the industry day powerpoint.

How should small businesses engage (prime vs. subcontractor), and what teaming approaches are encouraged? Small Business & Teaming

Small business contract holders under ITES-3S are encouraged to submit propsoals. Other small businesses may pursue teaming/subcontractor relationships with ITES-3S contract holders

Are there specific niches or capabilities the Government seeks from small businesses? Small Business & Teaming

No specific set-asides or niches are explicitly reserved for small businesses. The scope is comprehensive across the IT enterprise, though subcontracting opportunities exist.

What subcontracting goals apply, and will DBE/SWaM credit be recognized in evaluation? Small Business & Teaming Subcontracting plans will be in-line with 252.219-7003

What are the evaluation factors and relative weighting across Technical, Past Performance, and Price? Evaluation, Orals & Key Personnel Answered in industry day powerpoint.

Will there be orals, demos, or technical challenges, and how will results feed the evaluation? Evaluation, Orals & Key Personnel There is no intent at this time to include oral, demos, or technical challenges are part of the evaulation factors

Which labor categories (if any) will be designated Key Personnel, and will LOIs be required? How many Key Personnel are there? Evaluation, Orals & Key Personnel

There is no intent at this time to include specific required labor categories, key personnel requirements, or LOIs. It is up to offerors, to decide the correcy mix of personnel to meet the performance requirements in the performance work statement

How does the Government balance O&M vs. engineering vs. transformation (automation/modernization) in this effort? Scope, Staffing & Performance

There is a significant focus on all three. Operations & Maintenance forms the core infrastructure support. Engineering is required for enterprise architecture and system design. Transformation is driven by Cloud FinOps, automation, and application modernization.

What is the anticipated workforce profile (FTE counts, functional distribution, on-site vs. remote)? Scope, Staffing & Performance

Specific headcount and functional distributions are not predefined and will depend on proposed staffing plans. On-site support is required during core hours; remote or hybrid roles are not normally permitted without explicit government approval.

What are the target service levels and enterprise performance metrics (e.g., service desk hours, ticket volumes, SLAs)? Scope, Staffing & Performance

Key operational targets include: Critical Services Uptime of 95% or higher; Less-Critical Services Uptime of 90% or higher; ACAS Scans at 98% or better monthly; ESS Scores maintained at 95% or higher; Account Creation within 2 business days; and User Training compliance at 95%.

Where is performance expected (contractor site vs. JPO facilities), and are remote/hybrid roles allowed? Place of Performance & Incumbent

Performance occurs primarily at government facilities across a three-tiered structure (e.g., Arlington, VA; Edwards AFB, CA; Fort Worth, TX).

Remote work requires explicit authorization.

Who is the incumbent, and what is the current contract number and approximate value? Place of Performance & Incumbent Information regarding the incumbent contractor, current contract number, and overall value is not available.

Is the ITAM process and supporting system in place and currently operational? If yes, please provide the name of the system and its technology. Scope, Staffing & Performance

ITAM requires significant maturation. Full lifecycle management, automated discovery, and comprehensive strategies are required. Asset transactions must utilize the government's PIEE module, and a software tool (like Helix) must be fully established for license tracking.

Will there be a structured transition-in and knowledge transfer from the incumbent? Place of Performance & Incumbent

Yes. Comprehensive Transition-In and Transition-Out Plans are required to ensure orderly handovers, maintain communication, and effectively transfer all work, data, and knowledge.

What clearance levels are required by task area, and is a Facility Clearance (FCL) needed at award? Clearances & Security Governance

Clearance requirements will be defined by the specific tasks and access needs identified in the contract’s DD254. The Government determines—per task area—whether Secret, Top Secret, SCI, or SAP access is required, and contractors must align personnel clearances accordingly. A Facility Clearance (FCL) is required when contract performance requires access to classified information.

How will SAP/SCI governance be structured (SSO/SSR model), and what obligations exist for SCIF/SAPF support (ICD-705/TEMPEST/EMSEC)? Clearances & Security Governance

SAP/SCI governance follows the established SSO/SSR framework, with the Special Security Officer (SSO) providing overall program level oversight of SCI security, accreditation documentation, and policy implementation, and the Special Security Representative (SSR) executing day to day SCI security operations within subordinate SCIF/T

SCIFs.

SCIF/SAPF facilities must comply with ICD

705 and ICS

705 construction and security standards, including physical, technical, acoustic, and intrusion detection requirements. TEMPEST/EMSEC protection must be incorporated with approvals from the Program Security Officer (PSO) and review by a Certified TEMPEST Technical Authority (CTTA).

Will industry support security architecture reviews and Zero Trust overlays for systems that touch F-35 data? Clearances & Security Governance Answered in brief How many systems/enclaves require RMF authorization and continuous monitoring, and what are current ATO timelines? Cybersecurity, RMF & Compliance Answered in brief Does the program expect continuous ATO (cATO), automated compliance validation, and Zero Trust maturity assessed against DoD ZTRA pillars? Cybersecurity, RMF & Compliance Answered in brief

Is Comply-to-Connect (C2C) in scope across the enterprise or tiered by enclave/region/criticality? Cybersecurity, RMF & Compliance C2C is in scope across the enterprise.

What are the program’s pain points with cybersecurity compliance (CMMC/NIST 800-171), and where can industry help most? Cybersecurity, RMF & Compliance Answered in brief

What improvements are sought in service desk, collaboration, and enterprise applications (including automation goals)? IT Operations, Service Desk & NOSC

Goals include enhanced customer service with reduced resolution times, improved real-time knowledge sharing via integrated collaboration tools (SharePoint/Teams), and widespread application modernization and automation.

Could you please provide approximate current/anticipated in-person support needs at Tier-1, Tier-2 and Tier-3 locations included? IT Operations, Service Desk & NOSC

Tier-1 and Tier-2 sites require on-site service desk support, while Tier-3 sites do not. Specific support volume needs for each tier are not defined.

How many users need to be supported across the JPO? Does this include CONUS based personnel, foreign partners and FMS? IT Operations, Service Desk & NOSC

A total user count is not defined however an approximate of 3600 can be used and includes international partners, and Foreign Military Sales (FMS) customers globally.

How many contractors provide support in OCONUS locations? IT Operations, Service Desk & NOSC OCONUS support is done via travel as needed.

How will NOSC monitoring and incident response transition be handled across regions and 24/7 ops? IT Operations, Service Desk & NOSC

A Network Operations Security Center (NOSC) must be established for 24x7 enterprise network outage response. An enterprise-level Incident Response Plan must be maintained and regularly assessed via tabletop exercises.

Which tools/platforms are currently mandated (e.g., ServiceNow, monitoring stack), and can vendors propose alternatives? IT Operations, Service Desk & NOSC

Current environments use tools like BMC Helix (or standard ITSM), Microsoft 365, Cisco AnyConnect, LogRhythm, and SolarWinds.

Mandatory government systems (eMASS, PIEE) must be used, but industry-standard alternatives for commercial tools may be proposed subject to approval.

Is ITAM (license/asset management) fully established, and what data will be provided to support continuous inventory? IT Operations, Service Desk & NOSC

ITAM requires significant maturation. Full lifecycle management, automated discovery, and comprehensive strategies are required. Asset transactions must utilize the government's PIEE module, and a software tool (like Helix) must be fully established for license tracking.

What is the current and target-state DevSecOps environment (tools, pipelines, hosting platforms), and the largest gaps? DevSecOps, Cloud & Azure IL5

DevSecOps and related acitivites are hosted on a seperate environment not under this contract

What cloud platforms are in scope, and what’s the migration/consolidation roadmap (esp. Azure IL5 hybrid)? DevSecOps, Cloud & Azure IL5 Azure IL5 Cloud. Migration activities of on-prem datacenter is complete.

Most items in scope with relation the cloud is sustainment and efficency

Who is responsible for subscriptions/operations/security in IL5, and how are FinOps cost controls enforced? DevSecOps, Cloud & Azure IL5

The contract awardee will be responsible for all cloud related management. We do have an existing FinOps tools that helps with cost management.

Will PQC/NSA CSfC alignment or DoW CIO guidance be reflected in the RFP for CONUS/OCONUS traffic? DevSecOps, Cloud & Azure IL5

Are the tools / systems functionality needs to be managed and enhanced as part this contract support, or, just their infrastructure and configurations need to be maintained? (e.g: BMC Helix or Industry Standard ITSM, Electronic Flight Clearance Tool, SharePoint sites, Microsoft 365 applications etc.). If functionality needs to be enhanced/maintained, which tools/systems need to be configured and functionality maintained? DevSecOps, Cloud & Azure IL5

Both are required. Responsibilities cover infrastructure/configuration maintenance as well as functional support, including software selection, adoption, migration, upgrades, and user administration.

How will new tools/capabilities be evaluated and inserted under this contract (ODC or flexible teaming allowed)? DevSecOps, Cloud & Azure IL5

Evolving requirements and new capabilities will be processed formally as special projects, utilizing Potential Change Orders (PCOs) and Requests For Proposal (RFPs) to negotiate modifications.

What are the expectations for enterprise data governance and cross-directorate sharing (APIs/open architectures)? Data, AI/ML & Analytics

High emphasis is placed on data integrity, security, and knowledge management to ensure information sharing. Specific open architecture or API technical standards are not detailed. However, JPO follows guidances from DOW

Where does the JPO see the highest ROI for AI/ML (cyber defense, predictive maintenance, enterprise ops)? Data, AI/ML & Analytics

While AI process development and alignment with overarching AI strategies are required, the specific operational domains yielding the highest ROI are not identified.

How is the program approaching MLOps/model governance for multi-domain data? Data, AI/ML & Analytics

Specific approaches to MLOps, model governance, and multi-domain data management are not currently detailed. However JPO follows directive on AI/ML related technologies from DOW

What data accessibility limitations exist today, and what changes unlock AI adoption? Data, AI/ML & Analytics DOW dictates what AI adoption tools we may access and utilize.

Currently we are using GEN AI. CoPilot, what other tools are allowed?

Is confidential computing (enclave-based execution) considered for sovereign separation of multi-national analytics? Data, AI/ML & Analytics

How will the unclassified IT service support the transition from ALIS to ODIN, and what integration touchpoints exist? ODIN/ALIS & Sustainment It will only support with IT services as described in the PWS.

What are the JPO’s top initiatives to improve fleet readiness and reduce sustainment cost per tail per year? ODIN/ALIS & Sustainment This contract is not for Air System IT Services Where can industry help most with supply-chain resilience and full asset accountability (GFP/spares/inventory)? ODIN/ALIS & Sustainment This contract is not for Air System IT Services

How is the JPO improving auditability of financial statements and contractor-reported costs? ODIN/ALIS & Sustainment

Financial tracking is enforced through the required submission of detailed monthly expenditure reports and rigorous cloud cost management via a defined FinOps strategy.

How will enterprise architecture deliverables drive decisions to modernize/repatriate/retire/migrate the 18+ custom apps? Architecture & Integration

Detailed "as-is" and "to-be" architecture artifacts and roadmaps must be developed to guide decisions on whether to modernize, repatriate, retire, or migrate custom applications.

How many or what % of the applications of the 18+ applications and 170+ software titles mentioned in Section

3.1 are cloud hosted? Please provide any existing plan and timeline to migrate the remaining applications. Are these applications developed and maintained by this task order contractor team? Architecture & Integration

All 18+ applications are hosted in some form of Azure cloud. They are developed and managed by the task order contractor team. Many of the 170+ software titles are subscriptions, some are loaded directly to a laptop, some are hosted on a server where specific assets connect to that server and share storage space. All are managed by this task order contractor team.

Key deliverables include the design, implementation, and optimization of database structures, ensuring high availability, performance, and scalability to meet evolving mission needs. - Is this in support of the 18+ applications mentioned in 3.1? Architecture & Integration

Ye, this would support the 18+ applications as well as for development teams within the organization that are building tools for the PMO they support.

Is there an existing license management system with information about current software in use? If yes, please provide its COTS/technology details and volume of data it manages. If no existing system, is the contractor expected to implement a new system from scratch? Architecture & Integration

There is an automated tracking tool for software licenses - BMC Helix that is currently being established by the current contractor. It will only cover software on prem and in Azure. We are looking to integrate all environments/enclaves.

Support the lifecycle of applications (design, build, integrate, test, implement, deploy, operate, and optimize) from a government-approved data center. – Can you confirm if the scope involves full SDLC or infrastructure support operations? How many applications need to be supported across their lifecycle? Could you provide related additional details for each to include scope, functionality, current state, technology, # of users they support? Architecture & Integration

There are 18+ applications that require support across their lifecycle.

Many of the applications are low/no-code applications developed in MS Power Apps and also MS Dynamics.

What are today’s biggest integration challenges between legacy systems and emerging digital capabilities? Architecture & Integration

How will scope changes or evolving requirements be handled post-award? Roles, Certifications & Other

We introduce new capability needs via the ticketing system and various other means (PPRB, Leadership Sync, etc) and vetted for approval/sourcing. Should we say something about incoming projects throughout the program that are expected to be prioritized by the Gov and handled by the contractor? The scope can range anywhere from infrastructure support to hardware buys and software application purchase/development and deployment.

What defines ‘exceptional performance’ in the first 12 months beyond meeting baseline SLAs? Roles, Certifications & Other CPAR ratings per Reference FAR 42.1503, Table 42-1

Will the Government publish an attendee roster, agenda, or read-ahead package prior to Industry Day? Logistics & Event Admin (Industry Day) All information that is possible to publish will be publicized on sam.gov folllowing industry day

Will there be time for 1-on-1 discussions at Industry Day, and how will questions be captured for SAM.gov? Logistics & Event Admin (Industry Day)

There will be no 1-on-1 discussions at industry day. There will be a time period to submit follow-up questions after industry day. All questions and answers will be published on sam.gov following that time period.

Sheet1