STATEMENT OF OBJECTIVE

BUILDING 1044: Mount Rack Storage Filer System Acquisition & Integration (SCIF

Environment)

New Mexico Air National Guard

2251 Air Guard Drive S.E. Kirtland AFB, NM 87117

Date: 21 July 202618 August 2026

Table of Contents 1 Purpose 2 Scope 3 Current Equipment 4 Technical & Operational Objectives

a. System Equivalency & Capacity

b. Disaster Recovery & Data Management

c. High Availability & Connectivity 5 Logistics, Safety & Site Operations

a. Workplace Safety & SCIF Migration

b. Material Disposition & Training 6 Security & Military Installation Access

a. Personnel Clearances & Base Access

b. AFNet, Supply Chain, & Data Sovereignty 7 Schedule, Work Hours & Execution

a. Work Hours & Holidays

b. Execution Window & Work Planning 8 Deliverables, Testing & Quality Assurance

a. Quality Control & System Testing

b. Operations & Maintenance Manuals 9 Contracting & Regulatory Compliance

a. Subcontracting Opportunities

b. SAM Registration 1 Purpose 2 Scope 3 Current Equipment 4 Technical & Operational Objectives

a. System Equivalency & Capacity

b. Disaster Recovery & Data Management

c. High Availability & Connectivity 5 Logistics, Safety & Site Operations

a. Workplace Safety & SCIF Migration

b. Material Disposition & Training 6 Security & Military Installation Access

a. Personnel Clearances & Base Access

b. AFNet, Supply Chain, & Data Sovereignty 7 Schedule, Work Hours & Execution

a. Work Hours & Holidays

b. Execution Window & Work Planning 8 Deliverables, Testing & Quality Assurance

a. Quality Control & System Testing

b. Operations & Maintenance Manuals 9 Contracting & Regulatory Compliance

a. Subcontracting Opportunities

b. SAM Registration

Statement of Objectives (SOO)

Mount Rack Storage Filer System Acquisition & Integration (SCIF Environment)

1 | P a g e

July 21, 2026August 18, 2026

1 Purpose

The purpose of this acquisition is to procure, install, configure, and migrate a highly available, redundant Enterprise Storage solution. The primary objective is to ensure resilient, high-performance data storage, tiering, archival, and disaster recovery (DR) capabilities while maintaining strict compliance with Air Force Network (AFNet) standards, Defense

Intelligence Agency (DIA) supply chain security, and physical workplace safety protocols within a Sensitive Compartmented Information Facility (SCIF).

The purpose of this acquisition is to procure, install, configure, and migrate a highly available, redundant Enterprise Storage Filer solution. The primary objective is to ensure resilient, high-performance data storage, tiering, archival, and disaster recovery (DR) capabilities while maintaining strict compliance with Air Force Network (AFNet) standards, Defense Intelligence Agency (DIA) supply chain security, and physical workplace safety protocols within a Sensitive Compartmented Information Facility (SCIF).

2 Scope

This requirement encompasses hardware delivery, logical configuration, network integration, disaster recovery implementation, robust system testing, and system administration training for a minimum 50TB net usable storage environment on Day 1 (configured to easily scale to

100TB in the future without a forklift upgrade), utilizing a flexible architecture of at least two

(2) physically independent storage arrays (providing high-availability at the primary production site and an independent node at the Disaster Recovery site). The scope includes rigorous work planning, quality control, and the physical tear-down of legacy materials. The contractor shall un-rack and stage all legacy hardware as directed by the Government;

however, no legacy materials, components, or e-waste are authorized to leave the facility. All physical installation, migration, logical configuration, and material handover will occur strictly within the SCIF.

This requirement encompasses hardware delivery, logical configuration, network integration, disaster recovery implementation, robust system testing, and system administration training for a minimum 100TB storage environment distributed across three separate filers. The scope includes rigorous work planning, quality control, and the physical tear-down of legacy materials. The contractor shall un-rack and stage all legacy hardware as directed by the

Government; however, no legacy materials, components, or e-waste are authorized to leave the facility. All physical installation, migration, logical configuration, and material handover will occur strictly within the SCIF.

2 | P a g e

July 21, 2026August 18, 2026

3 Current Equipment

The current Storage Area Network (SAN) infrastructure supporting the 250 IS environment is composed of three (3) HPE MSA 2050 storage arrays and two (2) dedicated management servers configured as follows:

System

Component

Hardware

Model

Quantity Role / Configuration Storage Media Per Array

Primary SAN

Storage

HPE MSA

2 Primary storage pool configured in a mirrored (high availability) architecture.

• 10 x 12 TB SAS Hard Drives•

2 x 2 TB SAS Management

Drives

Disaster Recovery

(DR) SAN

HPE MSA

1 Dedicated Disaster Recovery Site (DRS) node utilizing software-based replication to back up the primary configuration.

• 10 x 12 TB SAS Hard Drives•

2 x 2 TB SAS Management

Drives

Primary

Management

Server

HPE ProLiant

DL325 Gen10

1 Dedicated management server hosting orchestration software for the primary mirrored SAN configuration.

N/A (Compute/Mgmt)

DRS

Management

Server

HPE ProLiant

DL360 Gen9

1 Dedicated management server hosting replication and backup software for the

DRS SAN.

N/A (Compute/Mgmt)

4 Technical & Operational Objectives

The contractor shall offer and implement a highly resilient enterprise storage solution that achieves the following operational capabilities, ensuring at a minimum that the offered system possesses the exact same capabilities, functions, and performance metrics as the legacy system, or better, while delivering a minimum of 50TB of net usable storage capacity on Day 1 with a seamless, non-disruptive path to scale to 100TB in the future.

The contractor shall offer and implement a solution that achieves the following operational capabilities, ensuring at a minimum that the offered system possesses the exact same capabilities, functions, and performance metrics as the legacy system, or better:

a. System Equivalency & Capacity

The minimum offered solution must meet or exceed all current legacy system functions, capabilities, and performance baselines. The architecture must deliver a minimum of 50TB of physical, formatted net usable storage capacity on Day 1 (aggregate across the primary environment, before any software deduplication or compression is applied), and must be fully

3 | P a g e

July 21, 2026August 18, 2026 capable of scaling up to 100TB in the future simply by adding drives, without requiring a forklift upgrade or new controller heads.

The system must utilize a flexible architecture composed of at least two (2) physically independent storage arrays (providing physical redundancy and disaster recovery separation).

The storage pool must feature a minimum of 2TB of high-performance Enterprise-grade SSD technology (such as Write-Intensive or Mixed-Use SAS/NVMe SSDs, or equivalent performance/endurance tiers) to handle high-frequency random IOPS and VMware user profile workloads, enabling full storage virtualization and automatic tiering.

The minimum offered solution must meet or exceed all current legacy system functions, capabilities, and performance baselines. The architecture must deliver a minimum of 100TB

Usable Total Storage distributed across three separate filers, featuring a minimum of 2TB

SLC Flash Storage (or equivalent performance) and enabling full storage virtualization.

b. Disaster Recovery & Data Management

The contractor must integrate a comprehensive, local DR solution to support Continuity of

Operations (COOP). This must include secure asynchronous IP/iSCSI-based data replication to the physically separate DR array, supporting continuous data synchronization. The replication architecture must natively support the future physical relocation of the DR array to another on-base facility without requiring software re-licensing or re-architecting.

Storage data protection must support either traditional hardware-selectable RAID levels (with a minimum of dual-drive failure tolerance, e.g., RAID 6) or modern, equivalent software-defined storage (SDS) data protection algorithms (such as Erasure Coding or RAID-Z2) capable of tolerating the simultaneous failure of two (2) physical drives without data loss or downtime.

The system must provide independent archival and backup capabilities utilizing logical air-gapping and data immutability (Write-Once, Read-Many / WORM) locally within the secure facility to protect the backup repository from unauthorized modification, deletion, or encryption. Physical tape libraries and external cloud-based object storage are out of scope.

The contractor must integrate a comprehensive DR solution to support Continuity of

Operations (COOP), including secure data replication, automated failover, and robust backup/restore processes. Data management must support automatic tiered storage, allow the allocation of multiple RAID levels on the same storage tier, and implement independent archival capabilities.

4 | P a g e

July 21, 2026August 18, 2026

c. High Availability & Connectivity

The system must ensure high availability through fully redundant, active-active hot-swappable controller modules, redundant power supply units (PSUs), and redundant cooling modules to ensure zero downtime and seamless controller failover.

Connectivity requirements mandate a minimum of four (4) 10GbE network connections per system. The system must flexibly support both 10GBASE-T (RJ45 copper) and 10GbE SFP+

(capable of using multi-mode LC-to-LC fiber optic adapters/transceivers) to interface with the existing switch infrastructure. The contractor is responsible for coordinating with the

Government during the pre-proposal site visit and providing all necessary physical transceivers, adapters, and patch cables to execute a complete and functional physical connection.

The system must ensure high availability through redundant control modules, redundant power supply units (PSUs), redundant cooling modules, and redundant internal storage, alongside redundant iSCSI capability with seamless controller failover. Connectivity requirements mandate a minimum of four 10Gbit SFP network connections per system, capable of utilizing fiber adaptors.

5 Logistics, Safety & Site Operations

The contractor shall execute the physical deployment, staging, and material hand-over in strict accordance with military safety and SCIF security protocols.

Workplace Safety: All physical work, heavy lifting, and rack installation must comply with the US Army Corps of Engineers (USACE) Safety and Health Requirements Manual EM

385-1-1, as well as applicable OSHA standards.

SCIF Migration & Racking Staging: The contractor shall address and physically execute the movement and installation of equipment inside the SCIF. To ensure zero operational downtime during the data migration, the contractor must mount and run both the legacy and the new hardware simultaneously, utilizing a phased transition plan (staging, migration, cutover, and final rack placement).

Material Disposition & On-Site Retention: The contractor is responsible for the clean teardown and un-racking of all legacy storage arrays, management servers, rails, PDUs, and cabling. However, all legacy hardware, electronic components, and infrastructure material must remain on-site. The contractor shall stage all un-racked legacy materials at a designated location within the secure facility for final Government disposition and destruction. The contractor is strictly prohibited from removing any legacy IT materials from the facility. The contractor is only responsible for the off-base removal and disposal of standard commercial packing materials (cardboard, foam, and pallets) generated during the installation.

5 | P a g e

July 21, 2026August 18, 2026

Training: Provide comprehensive administrative and operational training for two (2) designated Government personnel within the secure facility.

The contractor shall execute the physical deployment in strict accordance with military safety and SCIF security protocols:

a. Workplace Safety & SCIF Migration

All physical work, heavy lifting, and rack installation must comply with the US Army Corps of Engineers (USACE) Safety and Health Requirements Manual EM 385-1-1, as well as applicable OSHA standards.

The contractor is responsible for physically executing and coordinating the movement of legacy storage arrays, management servers, and racks, and the installation of the new storage equipment inside the secure facility, working in close coordination with the Special Security

Officer (SSO).

To prevent operational downtime and ensure the safe transfer of the active 28 TB of production data, the contractor must utilize a phased transition plan (temporary staging in open rack "swing space," network-connected data copying, logical cutover, and final physical placement of the new hardware into the legacy rack slots) allowing both the legacy and new systems to remain powered and operational simultaneously during the migration phase.

All physical work, heavy lifting, and rack installation must comply with the US Army Corps of Engineers (USACE) Safety and Health Requirements Manual EM 385-1-1, as well as applicable OSHA standards. The contractor is responsible for physically executing and coordinating the movement of legacy filers/racks and the installation of new equipment inside the secure facility, working in close coordination with the Special Security Officer

(SSO).

b. Material Disposition & Training

The contractor is responsible for the removal and off-base environmental disposition of all non-salvageable materials, packaging, and legacy e-waste, excluding any storage media governed by security mandates. Additionally, the contractor must provide comprehensive administrative and operational training for two designated Government personnel within the secure facility.

6 Security & Military Installation Access

Contractor personnel must operate within strict DoD, Air Force, and Intelligence Community

(IC) constraints:

6 | P a g e

July 21, 2026August 18, 2026

a. Personnel Clearances & Base Access

Bidders are advised that unescorted access will not be granted under this contract. All contractor personnel performing on-site work inside the secure facility (SCIF) will be under continuous Government escort at all times. At a minimum, all contractor personnel performing logical configuration, data migration, and administrative console training must possess and maintain an active Secret clearance for the duration of the contract. Uncleared contractor personnel (such as physical movers, delivery drivers, or chassis installers) are permitted on-site to perform physical heavy-lifting and rack-mounting tasks, subject to continuous Government escort and local screen-masking protocols. Personnel must comply with all host Military Installation security directives and vehicle search protocols prior to arriving at the SCIF.

At a minimum, all contractor personnel performing on-site work must possess and maintain an active Secret clearance for the duration of the contract. Personnel must comply with all host Military Installation security directives, vehicle search protocols, and unescorted access procedures prior to arriving at the SCIF.

For Contractors that do not require CAC but require access to a DoD Facility and/or

Installation. Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center

Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (DODIO

2000.16V1_DAFI 31-145, DAFI 31-101 and DODM 5200.08v3_DAFMAN 31-101v3), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

For Contracts that require Handling or Access to Classified Information. For contracts that require handling or access to classified information, the contractor shall comply with FAR

Clause 52.204-2, Security Requirements, including the National Industrial Security Program

Operating Manual (DoD 5220.22-M) and applicable updates/changes. This clause involves access to information classified “Confidential/Secret/Top Secret” and requires contractors to comply with visitor Group Security Agreement (VGSA) when designated as a Visitor Group at all contractor operations located on Air Force/Air National Guard installations in accordance with this PWS. Contract personnel must be entered into the Defense Information

System for Security (DISS) and vendor will comply with paragraph1.6h above. A DD 254, DoD Contract Security Classification Specification, is required for all classified contracts.

Completion of localized security training (information protection related material) will be accomplished at the Wing/Unit level. Derivative Classification and Marking Classified CBTs may also be required as per assigned duties (i.e., SIPRNet).

7 | P a g e

July 21, 2026August 18, 2026

b. AFNet, Supply Chain, & Data Sovereignty

In alignment with the official sunset of the DoDIN Approved Products List (APL), the entire system offered must be fully compliant with active DISA Security Technical Implementation

Guides (STIGs) or possess vendor-supported/DISA-released STIG configurations. Offerors must provide proof of this STIG readiness with their initial quote submission. The contractor shall be responsible for fully implementing, hardening, and validating all applicable STIGs prior to final Government acceptance.

Furthermore, all proposed hardware must be successfully vetted through the Defense

Intelligence Agency (DIA) Supply Chain Risk Management (SCRM) process. To ensure this process can be initiated immediately upon technical evaluation and selection of the apparent successful offeror, bidders must submit all required Supply Chain illumination data

(including a complete Bill of Materials [BOM], CAGE codes, and country-of-origin details for all sub-components) directly with their initial quote. Final contract award is strictly contingent upon the selected vendor successfully passing the DIA SCRM vetting process.

To ensure strict data sovereignty, the system warranty must include a "Keep Your Drive"

(Comprehensive Defective Material Retention - CDMR) provision where failed drives containing classified data will remain securely on-site and will not be returned to the vendor.

The entire system offered must be actively listed on the Air Force Approved Product List

(APL). Furthermore, all equipment must be successfully vetted through the Defense

Intelligence Agency (DIA) Supply Chain Risk Management (SCRM) process. To ensure strict data sovereignty, the system warranty must include a "Keep Your Drive" provision where failed drives will not be returned to the vendor.

7 Schedule, Work Hours & Execution

To minimize mission impact, all execution must adhere to a strict operational schedule:

a. Work Hours & Holidays

All on-site work must be performed during normal operational hours, defined as Monday through Friday, 0700 to 1630 (7:00 AM to 4:30 PM) local time. No work shall be performed on observed Federal Holidays unless explicitly pre-authorized in writing by the Contracting

Officer (KO) and coordinated with the SSO.

b. Execution Window & Work Planning

All physical on-site execution—including teardown, staging, installation, data migration, logical cutover, testing, training, and final physical rack placement—must be completed within thirty (30) days.

8 | P a g e

July 21, 2026August 18, 2026

To ensure the contractor gets a full, uninterrupted 30 days of physical work time, the administrative lead time required for clearance verification, DISS visit processing, and base access approval (estimated at 10 to 14 calendar days post-award) shall not count against the

30-day period of performance. The 30-day work clock will officially begin only after the following two milestones are met:

All physical hardware has been delivered and documented as received at the Government facility.

The local Special Security Officer (SSO) has fully verified and approved the visit requests and base access credentials for the contractor's team.

Prior to the commencement of this 30-day window, the contractor must submit a formal

Work Plan detailing daily milestones, SCIF coordination steps, safety measures, and lead-time accounting.

All on-site execution, including tear down, rebuild, testing, training, and final hand-off, must be completed within thirty (30) days following the documented receipt of all physical hardware. Prior to the commencement of this 30-day window, the contractor must submit a formal Work Plan detailing daily milestones, SCIF coordination steps, safety measures, and lead time accounting.

8 Deliverables, Testing & Quality Assurance

The contractor must validate the system's operational readiness and provide formal documentation prior to hand-off. Government acceptance and authorization for final contract payment are strictly contingent upon the contractor successfully executing all required testing protocols, demonstrating high-availability failover, verifying client workstation connectivity, and delivering all required documentation deliverables.

The contractor must validate the system's operational readiness and provide formal documentation prior to hand-off:

a. Quality Control & System Testing

The contractor shall implement a Quality Control Plan (QCP) to govern the installation, ensuring all hardware, software, and network integrations meet OEM specifications and

DISA STIG hardening standards.

Comprehensive system testing must be conducted by the contractor, with results documented and provided to the Government for formal User Acceptance Testing (UAT). Testing protocols must include, at a minimum:

9 | P a g e

July 21, 2026August 18, 2026

High-Availability (HA) Failover Validation: Physically demonstrating seamless active controller failover under active load with zero downtime or connection drops.

Disaster Recovery (DR) Replication Validation: Verifying the initial seeding and successful asynchronous replication of the active 28 TB production pool to the DR array over the

10GbE LAN.

Data Integrity Verification: Providing documented checksum or file-verification results proving the 28 TB of active data was migrated with 100% integrity.

Client Connectivity Validation: Verifying that Windows 11 client workstations can seamlessly map, view, and read/write to the new storage volumes using standard SMB/CIFS network paths exactly like the legacy environment.

The contractor shall implement a Quality Control Plan (QCP) to govern the installation, ensuring all hardware and network integrations meet OEM specifications and AFNet standards. Comprehensive system testing, including HA failover, DR validation, and load testing must be conducted, with results documented and provided to the Government for User

Acceptance Testing (UAT).

b. Operations & Maintenance Manuals

Upon final hand-off, the contractor must deliver complete, site-specific Operations and

Maintenance (O&M) Manuals that include detailed architectural diagrams and administrative procedures.

9 Contracting & Regulatory Compliance

The contractor must maintain full compliance with federal acquisition standards:

a. Subcontracting Opportunities

In accordance with Section 8(d) of the Small Business Act (15 U.S.C. § 637(d)), the contractor shall agree to carry out the policy that small business concerns, veteran-owned, and minority-owned businesses shall have the maximum practicable opportunity to participate in the performance of contracts let by any Federal agency.

10 | P a g e

July 21, 2026August 18, 2026

Pursuant to FAR 19.702(a)(1) and FAR 52.219-9 (Small Business Subcontracting Plan), if the final awarded value of this contract exceeds the current statutory threshold of $900,000, the selected contractor (unless classified as a small business concern) shall be required to submit and negotiate a formal Subcontracting Plan with the Contracting Officer.

Because the estimated Independent Government Estimate (IGE) for this effort is below the active $900,000 threshold, a formal Subcontracting Plan is not anticipated to be required for this award

.In accordance with Section 8(d) of the Small Business Act (15 U.S.C. § 637(d)), the contractor shall agree to carry out the policy that small business concerns, veteran-owned, and minority-owned businesses shall have the maximum practicable opportunity to participate in the performance of contracts let by any Federal agency. If the contract exceeds the regulatory threshold, a formal Subcontracting Plan may be required.

b. SAM Registration

In accordance with the Federal Acquisition Regulation (FAR) provision FAR 52.204-7

(System for Award Management), all prospective offerors must be fully registered and maintain an active status in the System for Award Management (SAM.gov) database at the time of initial quote submission and at the time of contract award.

Pursuant to FAR 52.204-13 (System for Award Management Maintenance), the selected contractor must maintain an active SAM registration with current, accurate, and complete representations and certifications throughout the entire period of contract performance, including through final payment.

In accordance with the Federal Acquisition Regulation (FAR), all prospective contractors must be registered and maintain an active status in the System for Award Management

(SAM.gov) database prior to the award of any federal contract, basic agreement, basic ordering agreement, or blanket purchase agreement.