VCSFA RFP 26.130300-003-028_Amendment02.pdf

VIRGINIA COMMERCIAL SPACE FLIGHT AUTHORITY

REQUEST FOR PROPOSALS AMENDMENT

RFP 26.130300-003-028

SCADA Integrator Amendment 02

Issue Date: 6/17/2026

Subject: Request for Proposal (RFP) Amendment 02

Reference: SCADA Integrator

Issuing Organization: Virginia Commercial Space Flight Authority

101 West Main Street, Suite 602 Norfolk, VA 23510

Location of Work: Multiple Locations in the vicinity of:

Virginia Commercial Space Flight Authority Mid-Atlantic Regional Spaceport Wallops Island, 23337

This document shall serve as official notice of amendment to above Reference. Such notice is being provided to all offerors to which the original solicitation was sent. Offerors submitting a bid or proposal response shall acknowledge receipt of this solicitation amendment prior to the hour and date specified herein as follows: sign and return a copy of this amendment with the solicitation response being submitted, or, if the offeror has already submitted a response and desires not to change their bid or proposal, submit this acknowledgement signed and return prior to the solicitation deadline. If the Offeror has already submitted a response, the response may be withdrawn, revised and re-submitted if the supplier chooses. Any re-submitted response shall be accompanied by signed acknowledgment of this amendment. All amendment acknowledgments sent separately or with a revised bid or proposal shall have the solicitation number in the subject line of the email.

All bid packages shall be emailed to solicitations@vaspace.org on or before the final deadline of 6/24/2026, 4:00 p.m. EST.

The purpose of Amendment 02 is as follows:

1. To answer vendor questions, attached hereto.

All terms and conditions remain unchanged.

Name and Address of Offeror: ________________________________________________________________

Authorized Signature/Title Date Printed Name

Email Phone Number mailto:solicitations@vaspace.org

VIRGINIA COMMERCIAL SPACE FLIGHT AUTHORITY

REQUEST FOR PROPOSALS AMENDMENT

RFP 26.130300-003-028

SCADA Integrator Amendment 02

Questions and Virginia Commercial Space Flight Authority (VCSFA) Responses

1. RFP Reference: Attachment C, Section 5.1

Category: Technical-Platform

Question: The SOW requires Inductive Automation Ignition as the SCADA platform. Grantek proposes use of the latest stable release of Ignition 8.3 with the Perspective module for operator visualization. Please confirm whether this version and module selection aligns with VCSFA's current licensing and infrastructure plans, or whether a specific version or module set is required.

VCSFA Response: Yes, current development efforts use 8.3.1 and Perspective.

2. RFP Reference: Attachment C, Sections 3.2, 5.7 / Task 3 (D5)

Category: Technical – Infrastructure

Question: The SOW states that VCSFA is responsible for procuring server and virtual machine infrastructure, and that Task 3 / Deliverable D5 scopes the Integrator to review VCSFA's proposed hardware BOM prior to purchase finalization. Will VCSFA's proposed hardware BOM be made available to Offerors prior to proposal submission to support compatibility and sizing assumptions, or will it be provided to the awarded Offeror only post-award? If post-award only, please confirm whether Offerors should state explicit hardware assumptions in their proposals.

VCSFA Response: Depending on the timeline of current VCSFA internal development versus award date, the hardware BOM may be finalized and purchased prior to award date. BOM will be made available to the awarded offeror only post-award. Offerors are not required to state explicit hardware assumptions in their proposals.

VCSFA will review the BOM with the awardee to verify technical specifications.

See attached revised Attachment C – Scope of Work with modified language in Section 6.0, Task 3.

3. RFP Reference: Attachment C, Section 8.1, Item 5

Category: Technical – Architecture

Question: Acceptance criterion Item 5 references redundancy behavior meeting defined failover expectations, or gaps being documented and approved. Please clarify whether redundancy (e.g., Ignition gateway redundancy, network path redundancy) is required for Phase 1, and if so, at what level (gateway, network, historian). This directly affects scope, labor, and hardware BOM.

VCSFA Response: Server redundancy: Yes, the architecture will be hub-and-spoke. Each hub and spoke will have redundant servers. For phase 1: hub-primary, hub-secondary, site-1-spoke-primary, site-1-spoke-secondary, site-2-spoke-primary, site-2-spoke-secondary, site-3-spoke-primary, site-3-spoke-secondary.

Network redundancy: Yes, there will be redundancy and physically diverse

Gateways: Yes, there will be Ignition gateway redundancy Historian: Yes, there will be redundancy

4. RFP Reference: Attachment C, Section 6.0, Task 5, Item 5

Category: Technical – Alarming

Question: Task 5, Item 5 calls for implementation of basic alarming pathways as defined by VCSFA. To allow Grantek to scope the alarming effort accurately, can VCSFA provide the definition of the required alarming pathways, or a high-level description of alarm types, priority tiers, and notification methods expected in Phase 1?

VCSFA Response:

Alarm types:

[1] Process = tag-based limits [2] Communication = loss of communication with PLC, network [3] Power = utility power loss, UPS fault [4] Safety = conditions that impact personnel safety or environmental compliance [5] System = SCADA server, historian, database, application, gateway failures Alarm Tiers: low, medium, high, critical Notification methods: Heads-Up-Display (HUD), email notifications

5. RFP Reference: Attachment C, Section 6.0, Task 7

Category: Technical – Training

Question: Task 7 requires operator and administrator training. To properly scope this effort, please clarify: (a) How many training sessions are required for each audience (operators and administrators)? (b) Will any training sessions need to be conducted outside of standard weekday dayshift business hours (e.g., evenings, weekends, or shift-change windows)? (c) What is the expected duration per session (e.g., half-day / 4 hours, or full-day / 8 hours)?

VCSFA Response: Operators – 1 training session and a training PowerPoint for future reference. Administrators

– 1 training session and a training PowerPoint for future reference. No trainings shall be conducted outside of standard weekday business hours. Expected duration for operators and administrators will be half-day for each.

Total of 1 day of training.

6. RFP Reference: Attachment C, Section 5.10, Item 5

Category: Technical – Configuration Management

Question: Section 5.10, Item 5 prohibits use of public repositories or public issue trackers for VCSFA work products without written approval. Grantek's standard project delivery toolset includes Atlassian Jira (issue and defect tracking) and Confluence (documentation), both hosted on Grantek's enterprise Atlassian Cloud instance with access controls limited to project personnel. Please clarify whether hosted, access-controlled enterprise tools of this type would be considered public under this requirement, or whether all issue and documentation tracking must occur exclusively within VCSFA's GitLab environment.

VCSFA Response: VSA IT will have to approve the use of any external software prior to use. The source of truth for the SCADA project will be the MARS GitLab and MARS Project. All issue and documentation tracking must occur exclusively within VCSFA’s resources.

7. RFP Reference: Attachment C (both instances)

Category: Document Clarification

Question: The RFP package includes two copies of Attachment C (Scope of Work). The first instance (pages 11-

24) carries RFP number 26.130300-003-028, while the second instance (pages 25-38) carries RFP number 26.130300-003-000. Additionally, the Section 10.0 heading differs between the two copies: the first reads Proposal Option while the second reads Required Priced Option. Please confirm which instance is the controlling Scope of Work, confirm the correct RFP number, and clarify whether the Section 10.0 heading difference has any contractual significance.

VCSFA Response: The first instance of Attachment C, which carries RFP number 26.130300-003-028, is the correct and controlling version. The second instance, which carries the RFP number 26.130300-003-000 is hereby removed from the RFP.

See revised Attachment C – Scope of Work with modifications in response to questions herein.

8. RFP Reference: Attachment F, Sections 1 and 23

Category: Document Clarification

Question: The Contract for Services (Attachment F) references RFP number 25.130300-003-028 in both Section 1 (Scope of Work) and Section 23 (Contract Documents / Order of Precedence). The RFP cover page, solicitation, and all other documents consistently use RFP number 26.130300-003-028. Please confirm the correct RFP number and issue a corrected contract document, as this discrepancy creates ambiguity regarding which solicitation the contract instrument governs.

VCSFA Response: Confirming that the correct RFP number is 26.130300-003-028. A corrected copy of the sample contract document is attached.

9. RFP Reference: Attachment F, Section 2(c)

Category: Contract – Terms

Question: Section 2(c) of the Contract for Services states that invoices must be received by VCSFA within thirty

(30) days of delivery of services. For a fixed-price contract structured around milestone deliverable acceptance, please clarify: (a) Does the 30-day invoice submission clock begin upon Integrator delivery of a deliverable to VCSFA, or upon VCSFA written acceptance of that deliverable? (b) If VCSFA's acceptance review extends beyond 30 days from Integrator delivery, will the Integrator remain eligible to invoice upon acceptance without being considered non-compliant with the 30-day requirement?

VCSFA Response: The 30-day invoice submission period would begin upon VCSFA written acceptance of a deliverable. However, VCSFA expects to negotiate a payment plan with the Successful Offeror, and the Parties may mutually agree to modify this contractual term, if needed, in the final contract.

10. RFP Reference: Attachment C, Section 5.4 / Task 4

Category: Technical – Protocols

Question: Section 5.4 states that Phase 1 sites use various communication protocols but does not identify them.

Task 4 references a Site 3 tenant interface and a Site 4 building automation system boundary as specific integration challenges. To allow Offerors to accurately scope driver licensing, device configuration, and interface engineering effort, please provide: (a) The communication protocol(s) in use at each Phase 1 site (e.g., OPC-UA, Modbus TCP/IP, BACnet/IP, DNP3, proprietary); (b) The make/model of primary control systems or data sources at each site where disclosure is permitted; and (c) Any known protocol gateway or translation requirements between field devices and the Ignition gateway at each spoke site.

VCSFA Response: Development work for data translation from each site to the hub is well underway internally by VSA engineering. The details of the communication protocols, make/model of control systems, and translation requirements between field devices and ignition gateway will be disclosed to the awarded integrator. The ability to perform data translation from the hub to site 1, hub to site 2, hub to site 3, and hub to site 4, have been tested with current hardware/software configuration and is working. At this point in the design, the interface engineering effort for the integrator shall be more focused on technical review to ensure current state will meet all project requirements, and further build out the SCADA software to configure, visualize, and historize these datapoints.

11. RFP Reference: Attachment C, Section 4.0 / Sections 5.5, 7.2 (D4, D6, D10)

Category: Technical – Security/Disclosure

Question: Section 4.0 acknowledges that security-sensitive details may be provided via controlled appendix and/or NDA. Several deliverables (D4 Network and Segmentation Plan, D6 Ignition Architecture Plan, D10 As- Built Architecture Package) depend on network topology, VLAN structure, and DMZ boundary details that may be subject to disclosure constraints. To allow Offerors to accurately scope these deliverables and associated effort:

(a) What network and security information will be made available to Offerors prior to proposal submission, and through what process (e.g., controlled appendix, pre-award NDA)? (b) What information will be withheld until post-award? (c) Are there specific elements of the network or segmentation architecture that Offerors should treat as assumptions in their proposals, and if so, can VCSFA provide a baseline assumption set?

VCSFA Response: Parity will be maintained across bidders. VSA does not plan to share security-sensitive details regarding D4, D6, D10, etc. until contract award and NDA agreements are in place.

See revised Attachment C – Scope of Work with modified language in Section 4.0

12. RFP Reference: Attachment C, Section 10.0 / Attachment E

Category: Technical – Site 4 / OD1

Question: Section 10.0 describes OD1 (Site 4 one-way transfer/diode solution) as a required priced option because the Site 4 boundary determination may require a unidirectional transfer solution, indicating the determination has not yet been made. To allow Offerors to properly plan for the potential interaction between OD1 and the base Phase 1 schedule: (a) When does VCSFA expect to complete the Site 4 boundary determination? (b) Is it possible that OD1 could be directed concurrently with base Phase 1 work rather than sequentially, and if so, what is the anticipated impact on the Phase 1 delivery timeline? (c) Will the boundary determination outcome be communicated to Offerors prior to proposal submission, or should Offerors assume OD1 may be exercised at any point during Phase 1 execution?

VCSFA Response: Site 4 boundary determination schedule is unknown currently. Yes, it is possible that OD1 could be directed concurrently with base Phase 1 work. No, boundary determination outcome will not be communicated prior to proposal submission. Offerors assume OD1 may be exercised at any point during Phase 1 execution.

13. Can VSA provide any technical guidance on the type of technology required for the data diode to be optionally priced per section 10.0? We would expect a one-way optical gateway for transmitting Ethernet packets would be appropriate but we want to verify that. We also want to verify that the architecture will be a "spoke" Ignition gateway located in site 4 sending data via the one-way data diode to the "hub" Ignition gateway located in site 1.

VCSFA Response: Correct, one-way optical gateway would be appropriate. Correct, “spoke” Ignition gateway located in site 4 sending data via the one-way data diode to the “hub” Ignition gateway located in site 1.

14. RFP Attachment F Section 9 Subsection (1) - Please clarify if an active DDTC registration is required for participation in this solicitation and/or project.

VCSFA Response: An active DDTC registration is not required for participation in this solicitation and/or project.

15. I am reaching out on behalf of OpenVPN regarding this RFP. OpenVPN's Access Server solution can support portions of the requirements outlined in the solicitation. Could you please let us know whether you are considering solutions that address specific sections of the RFP rather than the full scope of requirements?

VCSFA Response: We are sourcing our servers through other means and are not interested in server solutions for this RFP.

16. RFP Reference: RFP Attachment C SOW p.11-38

Question: There seems to be two scopes of work in the RFP document, one titled "Attachment C – Scope of Work RFP 26.130300-003-028" on p.11-24 and another one titled "Attachment C – Scope of Work RFP 26.130300-003-000" on p.25-38. Please confirm that we should only be using the first one marked as "RFP 26.130300-003-028" as the official Scope of Work.

VCSFA Response: See response to question #7.

17. RFP Reference: RFP section IV.A.3, p.3-4

Question: Since we need to reference the applicable RFP page and paragraph numbers in our response, would VCSFA please provide an updated RFP that has corrected section IV.A.3 alphanumerics?

VCSFA Response: See attached.

18. RFP Reference: SOW 5.1/5.2

Question: The required software is Ignition; however, no additional detail was listed regarding version, modules, or licensing. Does VCSFA already have an Ignition license? If so, please provide the license version and included modules.

VCSFA Response: Ignition Gateway 8.3.1, development will be in Perspective, not Vision. Yes, VCSFA already has the licenses for all the hubs and spokes. Modules: UDP and TCP Drivers, Omron Driver, SQL Bridge, MariaDB JDBC Driver, BACnet Driver, PostgreSQL JDBC Driver, OpcCom, Siemens Drivers, Mitsubishi Driver, Micro800 Driver, Modbus Driver, Allen-Bradley Driver, Perspective, Reporting, Symbol Factory, Alarm Notification, MSSQL JDBC Driver, IEC 61850 Driver, OPC-UA, Legacy DNP3 Driver, Logix Driver, Historian Core, SQL Historian, DNP3 Driver.

19. RFP Reference: SOW 5.3

Question: The system described will be a Hub and Spoke architecture. Which of the requirements listed in section 5.3 apply to the spoke gateways?

VCSFA Response: All of 5.3 applies to all spokes.

20. RFP Reference: SOW 4.2

Question: Are there any "security-sensitive details" for this RFP that we need to sign an NDA and request access to?

VCSFA Response: If sensitive information is released during the solicitation period, it will be provided by secure Sharepoint link with the requirement to abide by our terms, below:

1. Non-Disclosure of Information: The provided information is considered confidential or proprietary information of the Virginia Commercial Space Flight Authority and may be used by you solely for participating in the above-referenced solicitation. Any unauthorized use or disclosure of the information may result in legal action.

2. Unauthorized Use: Unauthorized or improper use of this system is prohibited and may result in civil and criminal penalties. Unauthorized attempts to download information, change information, or defeat or circumvent security features are strictly prohibited.

3. Monitoring: Access through the secure link may be monitored and recorded.

Other sensitive information provided after contract award will be governed by the confidentiality terms in Section 6 of the sample contract in Attachment F.

21. RFP Reference: SOW 2.1

Question: The schedule sequence is for integration and validation to occur in order of site 1 and 2, then site 3, then site 4. Are there requirements for complete validation and acceptance of each site before beginning any integration work on succeeding sites? For example, can bench validation on site 4 occur concurrently with site validation on site 3?

VCSFA Response: No requirement for complete validation and acceptance at each site before beginning integration work on other sites. Yes, bench validation on site 4 can occur concurrently with site validation on site 3.

22. RFP Reference: SOW 6.0 Task 3

Question: Please provide the Hardware Bill of Materials referenced in Task 3.

VCSFA Response: Same as response to question #2 – BOM will be made available to the awarded offeror only post-award and once NDAs are complete. Offerors are not required to state explicit hardware assumptions in their proposals.

23. RFP Reference: SOW 5.14, 6.0–8.0

Question: Please clarify the expected review and approval turnaround time for contractor submittals (e.g., deliverables, test plans, and other required artifacts).

VCSFA Response: Anticipate ~1 month for VCSFA to review contractor submittals (proposals), spanning June- July 2026. VCSFA will conduct discussions/negotiations with selected Offeror(s) after proposal evaluation and determine a reasonable time period for review of submittals related to contact deliverables, which will be built into the contract schedule.

24. RFP Reference: RFP Section IV.A.3.g

Question: Please provide fixed lead times for hardware and platform components.

VCSFA Response: VCSFA has all Inductive Automation licenses. The primary and secondary hub servers are on site. The primary and secondary spoke server hardware lead times are unknown.

25. RFP Reference: RFP Section IV.A.3.g

Question: Please identify any blackout dates, restricted work windows, range/mission-driven constraints, holidays, or other schedule limitations that Offerors should account for when preparing the Phase 1 schedule, staffing plan, commissioning approach, and pricing.

VCSFA Response: VSA will work with the awardee and adjust the schedule accordingly once an NDA is signed.

26. RFP Reference: SOW 2.1, p. 12; 5.13, p. 17

Question: Please confirm whether the estimated tag count for proposal pricing should be based only on raw source points read directly from field devices/source systems.

VCSFA Response: Estimated tag counts are based only on raw source points read directly from field devices and none are derived measurements. There will be very minimal derived measurements (~ <5% of total tag count).

27. RFP Reference: SOW 5.4, p. 14; 5.13, p. 17

Question: Please clarify who will define alarm thresholds, priorities, messages, deadbands, delay timers, and operator response guidance.

VCSFA Response: The project manager for the SCADA project will work with the integrator and VSA engineering to define all the above.

28. RFP Reference: SOW 5.4, 6.0 Task 4, 7.3 D3

Question: Please provide the per-site communication protocol inventory, including the nature of the Site 3 tenant interface.

VCSFA Response: Development work for data translation from each site to the hub is well underway internally by VSA engineering. The details of the communication protocols, make/model of control systems, and translation requirements between field devices and ignition gateways will be disclosed to the awarded integrator once NDAs are complete.

29. RFP Reference: SOW 7.2, 7.3 D4, 7.3 D10

Question: Please provide the current Network and Segmentation Plan and the as-built architecture package noted as “D10: Complete As-Built Architecture Package (currently at 30% design).”

VCSFA Response: The details of the Network and Segmentation Plan, as well as the architecture referenced within D10 will be disclosed to the awarded integrator once NDAs are signed.

30. RFP Reference: SOW 5.5, 5.11, 5.13

Question: Who is responsible for issuing and managing the certificates/PKI required for encryption in transit, including Ignition gateway-to-gateway, gateway-to-SQL Server, and client TLS connections?

VCSFA Response: VSA IT will be responsible for issuing and managing the certificates.

31. RFP Reference: SOW 3.2, 5.5, 7.3 D4

Question: Please confirm that VCSFA IT owns and implements all firewall/ACL changes, VLAN/DMZ configuration, and network segmentation, with the Integrator providing advisory support to define and verify requirements rather than performing implementation.

VCSFA Response: Correct

32. RFP Reference: SOW 5.14, 6.0 Task 8, 7.3 D14, 8.1

Question: What control baseline and checklist, such as NIST SP 800-171, CIS Controls, or a VCSFA-internal standard, will the Software Quality Auditor use to evaluate cybersecurity evidence for acceptance, and is a checklist template available to offerors?

VCSFA Response: Integrator will develop a baseline configuration for the Ignition Server Application following Ignition recommended security hardening practices and collaborate with VCSFA to tailor the baseline configuration to meet any limitations within the network boundary. The Ignition server host will be configured and administered by VCSFA with collaboration support by the Integrator. At this time a checklist template is not available for Software Quality Standards. Evidence will need to be provided by the Integrator to support NIST 800-171 control objectives.

33. RFP Reference: SOW 6.0 Task 8, 7.3 D14, 8.1

Question: Please confirm that required cybersecurity evidence is limited to documentation and configuration/security checklist artifacts and does not include independent control testing, penetration testing, or an ATO package within the base scope.

VCSFA Response: Penetration testing and a ATO package are not within the scope of work.

34. RFP Reference: SOW 5.14, 8.1

Question: How does VCSFA define a “critical defect,” and what defect-severity classification applies at the acceptance gate?

VCSFA Response: A critical defect during is a configuration or software issue preventing reliable and safe read-only operations, data logging, monitoring, integrity of communications, or sustainment long term of the system, resulting in acceptance requirements being unmet. VCSFA uses low, medium, high nonconformance classifications based on risk and consequence levels.

35. RFP Reference: SOW 5.14, 6.0 Task 8, 8.1; Attachment G

Question: Which party is responsible for vulnerability scanning and remediation?

VCSFA Response: VCSFA IT is responsible for scanning for vulnerabilities and remediation. The integrator will not perform enterprise vulnerability scanning and is not authorized to remediate vulnerabilities directly on VCSFA infrastructure.

36. RFP Reference: SOW 3.1

Question: Please define the expected post-acceptance on-call support model for the three-month T&M support period, including response times, coverage hours, escalation path, and whether after-hours support is required.

VCSFA Response: VCSFA will contact the Contractor with a request for Time & Materials support and a Task Order Statement of Needs. The Contractor shall provide VCSFA with a proposal to address the Statement of Needs within five (5) business days. The proposal shall state the staff members dedicated to the effort, estimated number of hours to complete the work, and a price proposal with a not to exceed cap. VCSFA will provide a notice to proceed for the Task Order, after which the Contractor shall start work within 10 days. Coverage hours are anticipated to be standard working hours (M-F, 7:00 a.m. – 5:00 p.m.). If VCSFA has a need for urgent/emergency support, the response shall be provided within 24 hours of a request.

37. RFP Reference: Attachment F

Question: Please provide a redacted copy of the Prime contract.

VCSFA Response: The Prime Contract referenced in Attachment F is a separate agreement between VCSFA and its federal funding partner. The Offeror won't be a party to that Contract. The Flowdown document in Attachment G of the RFP contains all the relevant clauses from the Prime Contract for this project.

38. RFP Reference: Attachment F

Question: Please provide a separate mutual NDA from the contract in the RFP.

VCSFA Response: VCSFA’s sample contract in Attachment F contains the non-disclosure and confidentiality provisions that will govern this agreement. If the Offeror wishes to propose additional or modified terms regarding non-disclosure, it may do so on the Exceptions to the RFP Form in Attachment H of the RFP.

39. RFP Reference: SOW 10.0; Attachment E Schedule Form

Question: Please confirm that the 45-calendar-day OD1 target duration is limited to Integrator-controlled design and procurement support.

VCSFA Response: Target complete within 45 calendar days of direction or integrated with base schedule if proposed by bidder.

40. RFP Reference: SOW 10.0; Attachment E Schedule Form

Question: Please clarify when and how OD1 will be authorized for execution, and what event starts the 45-calendar-day target duration.

VCSFA Response: OD1 is authorized when VCSFA issues a formal written notice by VCSFA Contracts, and that is the event that starts the 45-calendar-day target duration. The bidder may also propose to integrate the OD1 implementation with the base schedule.

41. RFP Reference: SOW 10.0; Attachment E Schedule Form

Question: Please confirm that vendor lead times and accreditation are excluded from the 45-calendar-day OD1 target duration.

VCSFA Response: Confirmed.

42. RFP Reference: SOW 10.0; Attachment E Schedule Form

Question: Please confirm that T&M is acceptable for OD1 accreditation activities.

VCSFA Response: Confirmed

43. Will any of the work require the integrator's presence onsite, or do you anticipate all the integrator's work will be remote? "Remote Support assumed"

VCSFA Response: Anticipate most work will be performed remote. Per 3.3, ‘VCSFA will perform or directly manage physical installation activities such as rack/stack, cabling, and field integration unless explicitly included as a priced contract line item. The Integrator shall include commissioning support required to validate connectivity, data ingestion, tag accuracy, historian logging, stale detection, access controls, and backup and restore demonstrations. The assumption is that the Integrator will perform this support remotely through VPN.’ If the Integrator requires onsite access to complete Phase 1 objectives, please identify what specific tasks and approximately when in the schedule the visit(s) are recommended, and highlight those as a priced contract line item.

44. Will there be any commissioning executions or site access constraints? No defined onsite presence requirement per site.

VCSFA Response: There is the potential for constraints to commissioning execution and/or site access. The proposal is for most work to be performed remotely. If there is onsite work required or recommended, please highlight those as a priced contract line item.

45. If onsite work is required and regarding EHS:

- Is drug/alcohol testing required?

- Is background check required?

- Is safety training required?

- Is any special PPE required?

- Is any other EHS need required?

VCSFA Response:

- Is drug/alcohol testing required? No

- Is background check required? Yes, coordinated with SCADA Project Manager and the VCSFA Security team

- Is safety training required? Yes, if on-site visits are recommended by the Integrator and included as a contract line item. Contractor will take an Access Training course prior to any on-site work.

- Is any special PPE required? Yes, if on-site visits are recommended by the Integrator. PPE will be dependent upon the location, and may include hard hat, steel toed shoes, safety eyeglasses, high viz vest.

- Is any other EHS need required? Contractor Safety Evaluation Form, Access training

46. When the final Phase 1 tag list will be provided? Whether tag set will be frozen prior to design baseline approval?

VCSFA Response: For the purposes of proposal preparation, Offerors should estimate roughly 2000 tags and 15 screens per Site. Actual tag or screen numbers may differ and will be provided to the Awardee. To develop proposals, a rate for price per tag is helpful to assist in estimating resources.

47. Whether writeback capability must be disabled at: Tag level, Device level or Gateway level?

VCSFA Response: In Phase I, all writeback capability shall be disabled at the Gateway level, Device level, and Tag level. This ensures no command, control, setpoint changes, or writebacks are permitted. If the Integrator has a more efficient way to ensure no inadvertent commands are sent to the sites, please highlight this in your proposals.

48. Please confirm if Ignition redundancy modules are required.

VCSFA Response: Redundancy within Inductive Automation’s Ignition platform will operate as a two-node system at each hub and spoke. There will be a primary and secondary gateway, and these licenses are already purchased.

49. Required compliance standard - NIST 800-53, NIST 800-82?

VCSFA Response: NIST SP 800-171 and CMMC 2.0 are baselines for protecting data and driving encryption requirements. VCSFA IT guidance references NIST SP 800-53 as the required control set for authentication and system hardening. NIST SP 800-82 is not mandated currently but would be an acceptable standard to drive best practices and help guide the SCADA system development.

50. Whether OD1 Site data diode solution includes hardware procurement?

VCSFA Response: VCSFA will procure the data diode solution.

51. Is the 30% Design document referenced in D10 available during the quoting phase?

VCSFA Response: No, the plan is to provide the 30% design document to the awardee once NDAs are completed.

ATTACHMENTS:

1. Revised Attachment C – Scope of Work

2. RFP Section IV, A, 3 – Revised Alphanumeric Format

3. Revised Attachment F - Contract for Services

Attachment C – Scope of Work

RFP 26.130300-003-028

1.0 Background

Virginia Commercial Space Flight Authority (“VCSFA” or “Virginia Spaceport Authority” or “VSA”) requests proposals for professional services to support Supervisory Control and Data Acquisition (SCADA) implementation at the Mid-Atlantic Regional Spaceport (MARS).

The contractor (Integrator) shall provide engineering deliverables and hands-on configuration and commissioning support for a multi-site SCADA solution using Inductive Automation Ignition as the required platform. The Scope of this contract is limited to what is referred to herein as “Phase 1,” which will focus on data ingestion, visualization and recording for select sites within the Mid-Atlantic Regional Spaceport (MARS) Complex, referred to herein as “Site 1,” “Site 2,” “Site 3,” and “Site 4.” Phase 1 is strictly read-only monitoring and data logging. No command/control, writebacks, or setpoint changes are permitted in Phase 1. Phase 2, which is outside of the scope of this contract, will expand capabilities to read and write for Phase 1 Sites as well as additional sites within the MARS Complex.

2.0 Scope

2.1 In-Scope Sites

MARS is a multi-site location requiring inter-site communications ability that will be completed in multiple phases. This initial scope shall be considered as Phase 1 and only utilized for read-only monitoring and data logging. No command/control, writebacks, or setpoint changes are permitted in Phase 1. Phase 1 scope includes the following Sites, which are facilities located within the MARS Complex. Physical separation between sites is nominally between 0.25 to 3 miles, connected primarily through a fiber optic network.

1. Site 1 (hub)

2. Site 2 (spoke)

3. Site 3 (spoke)

4. Site 4 (spoke)

Implementation sequence: VCSFA intends to implement and validate Phase 1 in the following order: (1) Site 1 hub and Site 2 integration, (2) Site 3 integration, (3) Site 4 integration.

Revised 6/17/26 Per Amendment 02

For the purposes of proposal preparation, Offerors should estimate roughly 2000 tags and 15 screens per Site. Actual tag or screen numbers may differ and will be provided to the Awardee.

2.2 In-Scope Outcomes

The Phase 1 solution shall achieve, at minimum:

1. Telemetry for the approved Phase 1 tag sets is visible at Site 1 (hub) in real time and matches source values within defined tolerances. A list of Phase 1 tag sets will be provided to the awarded offeror.

2. Historian logging is enabled for the Phase 1 tag sets and meets minimum retention requirements.

3. Stale or missing telemetry detection is implemented, visible to operators, and verified in testing.

4. Read-only enforcement is implemented and verified.

5. Backup and restore processes are documented and demonstrated.

6. Operator dashboards, trends, and basic alarming are implemented for Phase 1 use cases.

7. Project deliverables and handover artifacts are complete and sufficient for VCSFA to operate and maintain the system without vendor lock-in.

8. SCADA related databases required for tracking tags, historians, bills of materials, that reside on the hypervisor

2.3 Out-of-Scope

Unless explicitly included as a priced option or written contract line item, out-of-scope includes:

1. Command/control, writebacks, remote control, or setpoint changes.

2. Expansion to sites beyond the Phase 1 sites.

3. Data warehouse integration.

4. Electrical construction, field wiring, conduit work, and rack installation work performed by contractor trades.

5. Classified-to-unclassified transfer solutions except as the separately priced option defined in Section 10.0.

6. Data warehouse, which will synchronize with SCADA related databases

3.0 Contracting and Execution Model

3.1 Contract Type

VCSFA’s intended structure is:

1. The Contract will be fixed price for all Deliverables (as defined in Section 7.0) through completion and acceptance of Phase 1 Services. VCSFA may authorize additional services on a Time and Materials (T&M) basis using fully burdened hourly rates established in the Contract. Contractor shall be available to provide on-call support on a T&M basis for a period of up to three (3) months following completion of Phase 1 Services.

3.2 Responsibility Split

1. VCSFA is responsible for procurement and ownership of core platform items, including Ignition licensing and server or virtual machine infrastructure.

2. VCSFA is responsible for site access coordination, safety compliance, and internal information technology (IT) approvals.

3. The Integrator is responsible for the contracted deliverables and for providing configuration and commissioning support sufficient to meet the acceptance criteria.

4. VCSFA will designate a Software Quality Auditor responsible for independent review of Integrator-delivered software and configuration artifacts and test evidence for acceptance.

5. The Integrator shall support the Software Quality Auditor by providing timely access to required artifacts (including VCSFA GitLab repository history, Ignition exports and backups, scripts, interface mappings, test cases, executed evidence, and defect or issue logs) and by participating in quality reviews as requested.

3.3 Installation and Commissioning Boundary

1. VCSFA will perform or directly manage physical installation activities such as rack/stack, cabling, and field integration unless explicitly included as a priced contract line item.

2. The Integrator shall include commissioning support required to validate connectivity, data ingestion, tag accuracy, historian logging, stale detection, access controls, and backup and restore demonstrations. The assumption is that the Integrator will perform this support remotely through VPN.

Revised per Amendment 02

4.0 Procurement Communications and Parity Controls

1. During the solicitation, the Integrator shall not engage directly with VCSFA Engineering personnel except through the official Contracts-managed question and answer (Q&A) process.

2. Security-sensitive details may be provided in a controlled appendix and/or under non-disclosure agreement (NDA) as directed by VCSFA Contracts and Security, with parity maintained across bidders.

5.0 Technical Requirements

5.1 Required Platform

The Phase 1 SCADA platform shall be Inductive Automation Ignition.

5.2 Architecture

Phase 1 shall implement a hub-and-spoke model with Site 1 as the hub and site gateways at Sites 2, 3 and 4 as spokes.

5.3 High-Level Functional Requirements

The Phase 1 solution shall provide:

1. Real-time Read-Only monitoring of telemetry values.

2. Data logging (historian) and time-series trending.

3. Alarm or event detection pathways (even if limited in Phase 1).

4. User access controls and auditability appropriate for VCSFA operations.

5. Network connectivity across Phase 1 sites under IT and Engineering constraints.

6. Data visualization through operator dashboards and trends.

5.4 Site Interface Requirements

Phase 1 shall integrate data from sites 1-4, which use various communication protocols.

The Integrator shall support the development and validation of:

1. A Phase 1 Tag Database (tag names, descriptions, units, scaling, engineering ranges, scan classes, historian classes, and alarm thresholds where applicable).

2. Site Interface Control Documents (ICDs, interface control documents) sufficient to reproduce integrations and support troubleshooting, commissioning, and Phase 2 expansion.

5.5 Network Segmentation and Security

Phase 1 shall implement segmented networks, including Virtual Local Area Network (VLAN) segmentation and Demilitarized Zone (DMZ) boundaries where required. The Integrator shall support VCSFA IT in defining and verifying network, encryption at-rest, encryption in-transit, and boundary requirements as needed for Phase 1.

5.6 Data Integrity and Time Synchronization

The Integrator shall support definition and verification of time source and synchronization approach. All ingested data shall be timestamped consistently and traceably.

5.7 Historian and Data Retention

1. Phase 1 shall configure a historian suitable for long-term trending and analysis.

2. Minimum retention requirement is 2 years for Phase 1 data.

3. Historian backend baseline: Microsoft SQL Server (SQL, structured query language) hosted and administered by VCSFA IT. The Integrator shall provide database configuration guidance, sizing assumptions, and validation steps. VCSFA shall provide licensing and database administration.

5.8 Stale or Missing Telemetry Detection

The Integrator shall implement stale detection behavior for representative tags and ensure operators can see stale state and likely cause (source or communications loss).

5.9 Read-Only Enforcement

Phase 1 shall enforce read-only operation. Writebacks and control functions shall be disabled or access-restricted such that operators cannot control field devices.

5.10 Version Control and Work Product Management (VCSFA GitLab) The Integrator shall use VCSFA’s GitLab repository for all Phase 1 work products and shall comply with VCSFA IT policies for repository access and authentication.

1. VCSFA will provide and control access to the GitLab repository used for Phase 1.

The Integrator shall request user accounts and access through VCSFA.

2. All work products shall be committed to the GitLab repository, including Ignition exports and backups, scripts, tag exports, database scripts, interface mappings, test procedures and results, issue logs, and release notes.

3. The Integrator shall use merge requests for changes to scripts or material configuration logic, with documented review and approval prior to merge.

4. The Integrator shall tag each release intended for deployment to a production environment with a unique release tag and accompanying release notes.

5. The Integrator shall not use public repositories or public issue trackers for VCSFA work products unless explicitly approved in writing by VCSFA.

6. Credentials, private keys, and sensitive security details shall not be stored in the repository. Such items shall be handled per VCSFA IT policy and documented in a controlled manner.

5.11 Remote Access and Secure Connectivity

Remote access by the Integrator is permitted only through VCSFA-approved secure remote access methods and only when enabled and authorized by VCSFA IT.

1. Remote access shall use VCSFA-approved virtual private network (VPN) connectivity or an equivalent secure remote access solution as directed by VCSFA

IT.

2. Multi-factor authentication (MFA, multi-factor authentication) shall be used where supported by VCSFA systems and policy.

3. Integrator access shall be least-privilege and time-bounded, enabled only during approved work windows, and revoked when not in use.

4. Remote sessions shall be logged in accordance with VCSFA IT policy. Where VCSFA tooling supports it, session recording may be required.

5. Access to operational technology (OT) networks and field interfaces shall be mediated through segmented network boundaries and approved jump hosts where directed by VCSFA IT.

5.12 Environment Separation and Release Promotion

Phase 1 shall employ separate environments to support controlled development, validation, and production operations.

1. At minimum, a development environment (DEV) and a production environment (PROD) shall be maintained. Where feasible, a staging or test environment (TEST) shall be maintained to validate releases prior to production deployment.

2. Development activities and iterative changes shall be performed in DEV (or TEST as directed) and promoted to PROD only after completion of required testing and approval under change control.

3. The production environment shall be treated as a controlled baseline.

Configuration changes to PROD shall be performed only through approved releases and documented in release notes.

4. Virtual machine snapshots may be used to support rollback planning, but shall not replace Ignition gateway backups, documented restore procedures, and tested recovery steps.

5.13 Ignition Artifacts and Release Package Requirements

Each production deployment shall be accompanied by a release package stored in the VCSFA GitLab repository and associated with the release tag.

1. Ignition gateway backup file(s) for the hub and affected site gateway(s) (e.g., .gwbk) with documented restore steps.

2. Ignition project export file(s) for affected projects (export format as supported by Ignition).

3. Tag export(s) for the Phase 1 tag database, including tag hierarchy, scaling, alarm thresholds (if used), scan classes, and historian settings as applicable.

4. A module and version inventory for each Ignition gateway environment.

5. Database schema or configuration scripts (SQL, structured query language) if changes are required to support historian or reporting functions.

6. Release notes describing what changed, why it changed, and how it was verified.

7. Test evidence summary for the release, including executed test records and any open issues with disposition or mitigation.

8. Rollback plan identifying the steps to return to the previously accepted baseline.

5.14 Software Quality, Auditing, and Test-First Verification

Phase 1 relies on a combination of software and configuration (Ignition projects, tag models, historian configuration, and scripts). The Integrator shall provide verification artifacts suitable for independent audit and long-term sustainment.

1. The Integrator shall implement a software and configuration quality approach that enables auditable, repeatable verification of Phase 1 outcomes (read-only monitoring and data logging), including requirements-to-test traceability and defect handling.

2. The Integrator shall develop a Test Plan derived from the Phase 1 requirements baseline and the agreed Phase 1 tag set. Test cases shall define inputs or preconditions, steps, expected results, and required evidence.

3. The Test Plan shall be delivered for VCSFA review and approval prior to final build activities and prior to any production deployment. Changes to test cases that affect acceptance shall be approved before execution.

4. For custom scripts or complex configuration logic, the Integrator shall implement repeatable unit-level tests or automated checks where feasible. Where automation is not feasible, the Integrator shall provide manual test procedures that are repeatable and produce objective evidence.

5. For custom scripts, interface transforms, and any non-trivial logic, the Integrator is encouraged to apply a test-first approach (write tests or checks first, then implement changes to satisfy the tests). If a test-first approach is not used for a given component, the Integrator shall document the rationale and the alternative verification method.

6. The Integrator shall maintain an issue and defect log in VCSFA GitLab, link issues to relevant test cases and release tags, and provide disposition for all open items at time of acceptance.

7. The Integrator shall provide an Acceptance Evidence Package for each production release and for final Phase 1 acceptance, including executed test records, objective evidence, and an issue or defect log with disposition.

5.15 International Traffic in Arms Regulations (ITAR)

Please see Attachment F, Section 9. “Export Control and Compliance” for terms and conditions regarding ITAR.

6.0 Integrator Tasks

Task 1: Kickoff and Integrated Execution Plan Support

1. Participate in kickoff meetings.

2. Support refinement of responsibility assignment and schedule baseline.

3. Provide a weekly status package including schedule, risks, issues, and decision needs.

4. Establish and use the VCSFA GitLab repository for Phase 1 work products, including a change workflow using merge requests and release tags.

5. Provide a remote access approach for Integrator support activities, consistent with VCSFA IT policy (e.g., VPN access method, authentication, logging, and work windows).

Task 2: Architecture and Best Practice Review

1. Review hub-and-spoke architecture for scalability, redundancy, backups, and performance.

2. Provide written findings and recommendations.

Task 3: Hardware Bill of Materials Compatibility Review

Revised per Amendment 02

Prior to VCSFA purchase finalization, Review proposed hardware and approach including:

1. Servers or virtual machines, storage sizing, network interfaces.

2. Uninterruptible power supply (UPS) strategy.

3. Protocol gateway approach.

Provide a written compatibility assessment and recommendations to reduce rework and vendor lock-in.

Task 4: Interface Definition and Integration Advisory

1. Support development and validation of Site ICDs for Site 4, Site 2, and Site 3.

2. Provide troubleshooting support for boundary interfaces, including Site 3 tenant interface and Site 4 building automation system (BAS, building automation system) boundary.

Task 5: Ignition Configuration and Build Support

Provide hands-on support to implement and validate:

1. Ignition gateways (hub and site gateways) configuration.

2. Tag database implementation.

3. Historian configuration and trending.

4. Operator dashboards and screens.

5. Basic alarming pathways as defined by VCSFA.

6. Gateway backup and restore processes and validation.

7. Data translation and tag import from each site to SCADA.

Task 6: Test Planning and Commissioning Support

1. Develop or review test plans for bench validation (FAT-like, factory acceptance test-like) and site validation (SAT-like, site acceptance test-like).

2. Develop a Test Case Suite derived from the Phase 1 requirements baseline and agreed Phase 1 tag set, including defined evidence to capture for each test.

3. Provide a requirements-to-test traceability summary sufficient to demonstrate that each Phase 1 requirement is verified by one or more test cases.

4. Deliver the Test Plan and Test Case Suite to VCSFA for review and approval prior to final build activities and prior to production deployment.

5. Maintain an issue or defect log in VCSFA GitLab during test execution, link defects to test cases,…