AOI 1 - NCODE Automation PHASE 1 - 07 MARCH.pdf

Area of Interest (AOI) for

Next Gen Commercial Operations in Defended Enclaves (NCODE)

Project Number NCODE-25-0001 Commercial Solutions Opening Number W918Z25SA001 AOI Title NCODE Phase 1: Automation Issued By Army Contracting Command (ACC)

Aberdeen Proving Ground (APG), MD Submission Instructions To respond to this AOI, please refer to paragraph 4 of the AOI and the Commercial Solutions Opening, section 2.1, General Guidelines and section 2.2, Phase 1 Solution Briefs.

Solution Briefs Due Date/Time (Suspense)* 24 March 2025, 11:00 AM Eastern Time Submit Solution Brief To ACC-APG DC3oE NCODE Team:

usarmy.apg.acc.mbx.dc3oe-ncode-cso@army.mil

*Any submissions that are received after the suspense date/time listed above will be deemed late and not evaluated. It is the sole responsibility of the company to ensure that its submission is received in the inbox listed above before the deadline specified.

mailto:usarmy.apg.acc.mbx.dc3oe-ncode-cso@army.mil mailto:usarmy.apg.acc.mbx.dc3oe-ncode-cso@army.mil

1. BACKGROUND

Secretary Hegseth identified that rebuilding the military by matching threats to capabilities, to include reviving the defense industrial base (DIB), is a top priority of the DoD. Strengthening the cybersecurity of the DIB is a critical component in ensuring the DoD can rapidly field emerging technologies to battlefield.

The DIB is critical in achieving our national security goals and maintaining our technology advantage, and small businesses play an especially crucial role. Small businesses are at the forefront of innovation, developing cutting-edge technologies that enhance DoD capabilities.

Ensuring their cybersecurity protects these innovations from cyber threats and intellectual property theft, which allows DoD to benefit from the latest advancements. The DoD collaborates with small businesses to leverage their specialized expertise, and a strong cybersecurity posture ensures these partnerships can occur securely. Additionally, small businesses provide unique solutions that contribute to the DoD's competitive edge. Protecting their cybersecurity ensures they can continue to operate and innovate without disruption, maintaining the DoD's technological superiority. Their agility in adapting to emerging threats and technological changes further underscores the importance of safeguarding their cybersecurity.

Small businesses in the defense sector face increasing cyber threats due to their perceived weaker defenses, making them prime targets for cybercriminals and nation-state actors. These attacks can lead to data breaches, intellectual property theft, and operational disruptions, compromising the entire defense supply chain.

2. PROBLEM STATEMENT

Small businesses in the defense sector struggle to meet DoD cybersecurity requirements, such as DFARS 204.7500 and Cybersecurity Maturity Model Certification (CMMC) due to financial constraints and limited human resources. Implementing robust cybersecurity measures requires significant investment and dedicated personnel, which small businesses often lack. The administrative burden of extensive documentation and continuous monitoring also strains their capabilities. Addressing these challenges is essential to help small businesses achieve the necessary cybersecurity standards and ensure a secure defense industrial base.

The Army/DoD is pursuing a secure, cloud-based solution for small businesses in the defense sector to help achieve and maintain a robust cybersecurity posture. Managed security services will provide continuous monitoring and threat detection, while pre-configured controls will cover key CMMC areas. Automated reporting will simplify documentation, and advanced encryption will protect sensitive data. Training modules will build a security-aware culture, and the cloud-based capability will allow for scalable security without significant upfront investment. This approach will be cost-effective, reducing capital expenditure on hardware and infrastructure. It will provide access to cybersecurity experts, streamline compliance, and offer robust protection against cyber threats. The solution's scalability will allow small businesses to adapt to changing requirements and threats. By automating most cybersecurity requirements, small businesses will address their remaining, unique business-specific controls while maintaining their focus on core operations and innovation, contributing to a secure defense industrial base.

3. DESIRED CAPABILITY ATTRIBUTES

The NCODE capability must automate the following functions, and/or features, all of which must meet NIST Special Publication (SP) 800-171/172 controls.

1. Automated Cybersecurity. The capability must automate minimum “threshold” of NIST security controls identified in the attached shared responsibility matrix (SRM).

2. Automated Environment Instantiation and Tailoring. The capability must automate a tailorable environment that provides cybersecurity to ensure basic productivity and/or advanced resources (e.g. modern software development) meet NIST controls. Each small business must be able to tailor the environment so they can inherit the automated cybersecurity controls, while paying for any productivity services used by that small business.

3. Environment Isolation. The capability must be able to automate the instantiation of an isolated environment/workspace for each small business. The capability must protect small business intellectual property within the environment and enable sharing of information with authorized partners.

4. Virtual Desktop Access. The capability must provide a scalable, cloud-based virtual desktop interface (VDI) solution or equivalent, enabling DoD users to access securely from anywhere.

5. Identity, Credential, and Access Management (ICAM). The capability must provide only phishing-resistant, multi-factor authentication (MFA) and have access control mechanisms to limit system access based on user roles and permissions. The authentication solution should be FIPS validated and verify identity without relying solely on passwords or SMS codes. The solution should also enable use of Common Access Cards (CAC) to support collaboration with government partners.

6. Monitoring. This solution shall conduct critical monitoring and logging. This data should be available for third-party and/or government monitoring, alerting, and warning. Describe your automated solution designs, access, roles, and responsibilities (between you, the provider, and the government) for access to event logs.

7. Onboarding. The solution must support automated processes for vetting that small businesses and their employees have need-to-know access to shared collaboration spaces.

8. CMMC Level-2 Certification. The solution must demonstrate maturity by having a current CMMC Level 2 certification by a C3PAO or demonstrate a clear path to near-term certification.

9. CMMC Level-3 Certification. The solution should be able to obtain future CMMC Level 3 certification by DIBCAC. Please describe your roadmap to achieve NIST 800-172a objectives.

10. Cloud/Data Security. Any cloud-based solutions must demonstrate maturity by having at least a current FedRAMP Moderate certification or equivalency, or demonstrate a clear path to near-term certification. Cloud infrastructure, applications, and data must be ITAR compliant (geographically hosted in the US, and accessible only to US-persons).

11. Data Loss Detection and Protection. The solution should provide a path to auditability of data entering and leaving the protected environment, and enforce restrictions to reduce likely of unintended data loss.

12. Penetration Testing. Lastly, solution providers must have or agree to government-approved penetration testing within six-months of deployment.

4. Awarding Instrument and Proposal Instructions

This AOI solicitation will be awarded in accordance with the Commercial Solutions Opening (CSO) procedures detailed within W918Z25SA001 (NCODE CSO), posted to SAM.gov on 07 March 2025. The CSO outlines the guidelines for submitting solution briefs, pitches, and proposals and how the Government will evaluate responses to this AOI. The CSO can be found at: https://sam.gov/opp/c26396d0cf3848569eeccba694bd05c9/view.

As identified in paragraph 2.2 of the CSO, the Affirmation of Business Status Certification is attached to this AOI.

5. Solicitation Notes

In addition to the general guidelines included in the CSO, the following guidelines apply to this

AOI.

• The Government will give preference to submissions that demonstrate an innovative, existing, fully-automated, and reference-verifiable commercial ability to accomplish the desired solution attributes (1) through (9) listed above.

• If the Government does not receive any solution briefs that demonstrate an innovative, existing, fully-automated, and reference-verifiable commercial ability to accomplish the desired solution attributes (1) through (9) listed above, preference will be given to submission demonstrating existing and recent products that can be adapted for the solicited purpose with the least amount of non-recurrent-engineering effort.

• Academic research proposals are not desired.

https://sam.gov/opp/c26396d0cf3848569eeccba694bd05c9/view

• The period of performance / schedule for any Solution Brief or proposal submitted under this

6. Non-Government Advisors

As identified in section 5 of the CSO, non-government advisors may be used in the evaluation of Solution Briefs, Pitches, and during proposal development and negotiation. For this AOI, the Government anticipates using non-government advisors from the following contractor:

- The MITRE Corporation

7. Standards, References & Policies

- Defense Federal Acquisition Regulation Supplement (DFARS) 204.7500

- National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 rev. 2

- NIST SP 800-172