Amendment 1 - Attachment 1 - QandAs - CDM 3.27.26.pdf

HQ0034259WHSCSO/WHSCSO26AOI02

Amendment 1

Q&As – White Paper Submissions – DSCA CDM

The AOI document for Case Development Modernization mentions in the background that a prototype is currently under development.

Additionally, the Case Launcher product prototype is currently under development. This prototype includes capabilities such as initializing a case, creating, editing, and tasking case lines, reviewing and entering case data and a Single Tracking System prototype for tracking foreign military sales efforts throughout the Case Lifecyle per EO 14268. A modernized Case Development Life Cycle is critical to achieving the goals outlined in the executive order.

Can you provide additional details for the prototype.

1. What software is currently being used for the Prototype?

Answer: Customized prototype build with Front end in React with Material UI Components.

Back-end API's are being built in Kotlin and using the Quarkus framework. Front and back-end components are being packaged as container images.

2. Is there a separate contract for the prototype?

Answer: No contract was specifically awarded. We are using existing resources for prototype.

3. Is so, could you provide the Contractor Name and Contract number?

Answer: N/A

4. Legacy Database Architecture & Interim Compatibility: The AOI states a requirement for "developing and implementing an improved, modern data architecture while maintaining interim compatibility with a to-be-retired database". To ensure our proposed Data Engineering and Cloud Architecture approach is optimally aligned, could the Government provide the underlying technology stack (e.g., Oracle, MS SQL), the approximate data volume, and whether the current data schema is highly normalized or primarily unstructured?

Answer: Oracle database, highly normalized, with 791 unique tables, many of which triplicated across 3 schemas (Army, Navy, Air Force). Please refer to the IM&T technical standards.

5. Integration with the Case Launcher Prototype: The AOI mentions that a "Case Launcher product prototype is currently under development". Will the successful CDM contractor be expected to inherit the codebase of this prototype for further iteration, or is the expectation to build seamless API integrations between the new CDM system and the standalone Case Launcher prototype?

Answer: The successful CDM contractor should be expected to inherit codebase of this prototype.

6. Document Repository Migration Scope: The requirement outlines the need for a unified Task Management and Document Repository capability. Are there specific, disparate legacy document repositories (e.g., localized SharePoint instances, shared drives) that the Government anticipates migrating into this new unified system, and if so, what is the estimated volume of historical case documents, and is critical metadata (e.g., classification, creator, creation date) readily extractable from these legacy sources?

Answer: No, we don’t have specific, disparate legacy document repository

7. Case Launcher Prototype: The AOI mentions that a “Case Launcher product prototype is currently under development.” What are the specific integration points, APIs, or data standards used by the “Case Launcher product prototype”? Will documentation for this prototype be available to the awardee to ensure seamless integration?

Answer: APIs and Protocols:

o The system must support secure Application Programming Interface (e.g., Representational State Transfer Application Programming Interface, Simple Object Access Protocol Application Programming Interface) for data exchange.

o Data exchange should comply with DoD standards, including extensible Markup Language, JavaScript Object Notation, or other approved formats.

8. Security and Cloud Environments: The AOI says the solution must adhere to cybersecurity, accessibility, Zero Trust standards, and achieve an Authorization to Operate (ATO). Are there specific Department of War (DoW) Cloud Impact Levels (e.g., IL4, IL5, IL6) required for the system and the CI/CD pipelines? Is there a designated government cloud environment to which we must deploy?

Answer: IL5, DISA hosted Gov cloud

9. Does the Government require the modernized solution to perform real-time bi-directional synchronization with this legacy database, or is a one-time ingestion/migration into the new data architecture sufficient?

Answer: Real-time bi-directional synchronization until all legacy database is in a state to decommission.

10. Can the Government provide the estimated volume (terabytes) and variety of document formats (e.g., PDF, CAD drawings, legacy scans) currently residing in the DSAMS?

Answer: We don’t have estimated volume. DSAMS uses Excel, Word, PDF, Image files (.png, .jpg etc…)

11. Regarding the "Case Launcher product prototype" currently under development, are the existing APIs or data schemas for this prototype available to offerors to ensure the proposed CDM system "integrates seamlessly" as required?

Answer: Prototype is in development and it will be shared at the appropriate phase of the project.

12. Does the Government intend for the CDM platform to provide its own attribute-based access control (ABAC) at the document and field level, or will it rely on an external Enterprise Identity Provider (IdP) for all authorization logic?

Answer: Current system employs a combination of RBAC and ABAC. DISA Enterprise ICAM must be used, but ABAC functionality, such as edit permissions on a case being assignable to particular group (Government Activity which is an attribute of the person) must be maintained.

13. Has the DSCA identified specific Security Technical Implementation Guides (STIGs) or Risk Management Framework (RMF) overlays that apply to the use of LLMs in a Retrieval- Augmented Generation (RAG) architecture?

Answer: The DSCA has not yet identified specific Security Technical Implementation Guides (STIGs) or Risk Management Framework (RMF) overlays that apply exclusively to the use of Large Language Models (LLMs) in a Retrieval-Augmented Generation (RAG) architecture. We expect to be complaint with DoW LLMs framework.

14. Are there specific KPIs or SLAs regarding search retrieval latency or indexing speed that the modernized system must achieve to meet the goals of EO 14268?

Answer: Market recommended latency or indexing speed.

15. Can the Government clarify if a Top Secret (TS) Facility Clearance (FCL) is required at the time of the Phase 1 Solution Brief submission, or if a Secret-level clearance is sufficient for initial development?

Answer: Secret

16. To what extent does the Government prioritize a Unified Data Access Layer that can provide real-time visibility into legacy DSAMS data (including unstructured documents/PDFs) while simultaneously integrating with the new Case Launcher prototype and modern CDM data architecture?

Answer: The Government places a high priority on implementing a Unified Data Access Layer (UDAL)to ensure seamless access to legacy DSAMS data while supporting integration with the new Case Launcher prototype and modern Case Development Modernization (CDM) data architecture. The Government prioritizes the UDAL as a critical component of the modernization effort to:

• Ensure continuity of operations by providing real-time access to legacy DSAMS data.

• Enable seamless integration between legacy and modernized systems.

Support unified and efficient user experience for stakeholders.

17. To meet the rapid delivery goals of EO 14268, will the Government require the modernized system to support AI-driven semantic search (RAG) with sub-second retrieval latency, and have the applicable STIGs/RMF overlays for Generative AI already been identified for the CDM environment?

Answer: Yes, require support AI driven sematic search. We have not identified STIGs/RMF and plan to utilize DoD generative AI framework.

18. Given the multi-agency nature of the Security Cooperation community, does the Government require Attribute-Based Access Control (ABAC) at the document and field level to ensure strict data sovereignty and "need-to-know" across different MILDEPs and foreign partners within the unified CDM platform?

Answer: Yes

19. To ensure the solution is correctly configured for mutual long-term success, what level of SME and professional services support is expected to be integrated into the execution of this work?

Answer: SMEs who have knowledge of FMS case life cycle, FMS and Grant Training and Training Execution and familiarity with DSCA mission.

20. (DoW Problem Statement) AOI states "it should integrate seamlessly with the CDM system for efficient data exchange and reporting." What technology does the CDM use today?

Answer: Customized prototype build with Front end in React with Material UI Components.

Back-end API's are being built in Kotlin and using the Quarkus framework. Front and end back-end components are being packaged as container images. Reporting capabilities use IBM Cognos Analytics v12.

21. (Background) What technology is being used in the Case Launcher product prototype under development?

Answer: Customized prototype built with Front end in React with Material UI Components.

Back-end API's are being built in Kotlin and using the Quarkus framework. Front and end back-end components are being packaged as container images.

22. (Desired Solution Attributes) What is the size of the user population for the target solution?

Answer: Approximately 3000 to 4000 users with 250 – 400 concurrent users

23. (Desired Solution Attributes) How many fulfiller roles will need to be supported?

Answer: We need to collaborate with IAs and MILDPS part of HCD process to identify the required attributes. Legacy system currently houses over 200 distinct user roles. Our research indicated that it could be consolidated to 25-50 roles.

24. (Eligibility) If the prime responding to the AOI is a Non-Traditional Contractor, can they use a large business as a participating party?

Answer: Yes, as long as the Non-Traditional Defense Contractor is participating to a significant extent.

25. Should the Phase 1 solution brief address the full end to end case lifecycle, or focus primarily on the case development capabilities outlined in the AOI?

Answer: Specifically focus on Training Module outlined in AOI.

26. Per the CSO, companies may submit multiple solution briefs in response to any single AOI if each submission represents a separate and distinct concept. Will this be allowed for this AOI?

Answer: Yes – multiple solution briefs are allowed for this AOI as this requirement is aligned with the CSO.

27. What level of technical specificity is expected in Phase 1 responses, such as conceptual architecture versus specific technologies and integrations?

Answer: As outlined in AOI.

28. Should offerors assume integration with existing DSAMS and Case Launcher prototypes, or consider clean slate architecture for the proposed solution?

Answer: Clean Slate and integrated solutions will both be considered. Offeror should propose whichever solution will provide the best solution in the least amount of time.

29. What are the primary evaluation priorities for Phase 1 submissions?

Answer: Please review the CSO evaluation criteria, as this directly applies to this AOI.

30. Per the CSO, POPs should be no longer than 24 months, should Phase 1 responses include anticipated level of effort or staffing assumptions?

Answer: You may include as much detailed information as you deem necessary to describe your solution. While these details can be negotiable, they also help the team visualize your plan.

Additionally, please adhere to the response criteria in the CSO, which calls for White Papers for the initial response.

31. Should Phase 1 responses include proposed team composition or key roles, or will that be addressed in later phases?

Answer: You may include as much detailed information as you deem necessary to describe your solution. While these details can be negotiable, they also help the team visualize your plan.

Additionally, please adhere to the response criteria in the CSO, which calls for White Papers for the initial response.

32. Are there any predefined data classification levels or hosting environments that offerors should assume for Phase 1 responses?

Answer: Secret

33. Should Phase 1 responses propose a specific prototype scope or use case to be demonstrated in Phase 2?

Answer: Solution brief in Phase 1 and Pitch in Phase 2 as outlined in AOI.

34. Do graphics, diagrams, and tables count toward the page limit?

Answer: Yes.

35. Is there flexibility in font size or formatting requirements for graphics and visual elements?

Answer: Font size and formatting can be modified for graphics and visual elements so long as they are legible without having to zoom in. Please adhere to the Response section criteria in the AOI (attached P07), which requests White Papers for the initial response.

36. Commercial Solutions Opening, HQ0034259WHSCSO, Amendment 004: The Government has outlined in b.ii that, the "Solution meets the appropriate use of a CSO as defined in DFARS 212.7022." Can the Government confirm the accurate DFARS clause is DFARS 212.7000-7005?

DFARS 212.7022 does not appear to be related to CSOs.

Answer: That clause has been corrected. Please see Amendment 5 to the CSO.

https://sam.gov/opp/57e06075f9854dcf9cb8b05ee20fe2ca/review

37. P07 Area of Interest-CDM-3.20.26, Modernization language references data improvement but does not specify required data standards: Does the Government expect data products to conform to the existing Advana schema, or should industry define the canonical model?

Answer: Industry should define canonical model.

https://sam.gov/opp/57e06075f9854dcf9cb8b05ee20fe2ca/review

38. P07Area of Interest-CDM-3.20.26, ZT/ICAM language: Are there mandated ICAM or Zero Trust reference architectures (e.g., WHS, DoW CIO, Agency specific) to which we must align?

Answer: Yes

39. P07 Area of Interest–CDM-3.20.26, Documents indicate need for improved governance/security: Should ABAC be enforced at the data layer, workflow layer, or both?

Answer: Both

40. P07 Area of Interest-CDM-3.20.26, Modernization goals: Which performance outcomes matter most—cycle time reduction, auditability, data quality, or interface consolidation?

Answer: All

41. HQ0034259WHSCSO AMD 004, Section I & CSO procedural guidance: What architectural flexibility is permitted—can we re-platform DSAMS logic, or must early prototypes wrap existing systems?

Answer: Re-platform DSAMS

42. HQ0034259WHSCSO AMD 004, Phase 1 guidance: What technical maturity is expected for Phase 1 to qualify for a pitch/prototype invitation (e.g., minimal proof of concept, a working prototype with initial workflow execution and API integration, or a more advanced prototype with security, logging, and a stable demo environment)?

Answer: Minimal proof of concept.

43. P07 Area of Interest-CDM-3.20.26, DoW Problem Statement - "It should integrate seamlessly with the CDM system for efficient data exchange and reporting.": Systems that support FMS such as MISIL (Navy) and CISIL (Army) are due to be sunset and replaced with S3ALE and FMS ACES, respectively. Does Govt intend for this product to be compatible with the older systems (both COBOL-based) to provide coverage during the transition phase for those systems?

Answer: Yes. Each of the modernizing systems plans to continue to use the existing flat-file exchange until both parties are ready to modernize that exchange.

44. P07 Area of Interest-CDM-3.20.26, Phase 2 guidance: What Government furnished information/environments will be provided (synthetic DSAMS datasets, interface specs, target schemas, test tenants), and can we receive them before the pitch to ensure demonstrable integration?

Answer: No, it will be provided to final contract awardee.

45. Background: Who are the customers of the system? Are they internal to DSCA or external users/agencies (e.g. Army, Air Force, foreign governments)? Would there need to be dedicated portal/landing page for external customers to submit their requests, track the status of requests, etc.?

Answer: DSCA, IAs and MILDEPS. Access requests will be handled by DISA Enterprise ICAM. No foreign government access.

46. Background: Is training/change management in scope for this effort? If yes, what level does the Government expect (user guides, train-the-trainer)?

Answer: Yes both user guide and train-the-trainer.

47. DoW Problem Statement: What is the expectation from the system to provide/support cybersecurity initiatives? For example, is the expectation for the system to track cybersecurity initiatives throughout their lifecycle, track STIGs in the system, monitor compliance of different tools within the system, provide overall governance structure, etc.?

Answer: Expectation is not to track STIGs in the system but the system needs to meet all cyber security compliance.

48. DoW Problem Statement: Can the Government please expand the functionality required for the document repository? What features are we looking to incorporate in the system? For example, is the expectation to house reference documents, manage documents, etc.?

Answer: The document repository is expected to serve as a centralized system for housing reference documents, managing documents, and supporting collaboration for Case Development.

Key functionalities may include:

• Document Storage: Securely storing reference materials, case-related documents, and other relevant files.

• Document Management: Version control, metadata tagging, and search capabilities to ensure efficient organization and retrieval.

• Collaboration Tools: Enabling stakeholders to review, edit, and share documents within the system.

• Integration: Seamless integration with the Case Development Modernization system and other FMF systems to support workflows and data exchange.

Further details and requirements will be shared with vendors during the appropriate phase of the project. Vendors will also have the opportunity to propose enhancements or modifications to meet mission needs effectively.

49. DoW Problem Statement: How many integrations are required and to which systems?

Answer: There are 23 interface partners to IA execution and accountings systems, and other DSCA owned systems.

50. Background: Is the expectation for the solution to track case execution as well or will the process in the system end once funding is confirmed?

Answer: For FMS material cases, the process ends once funding is confirmed. For FMS and Grant Training, the process continues into financial execution and interfaces directly with the IA accounting systems.

51. Commercial Solutions Opening, II. CSO Procedure, a. General Guideline: Can the Government confirm that the period of performance is 24 months (One 12-month base, and one 12-month option year)? Given the complexity of DSAMS today, we recommend at least a 36 month (one 12 month base, and two 12-month option years) period of performance.

Answer: This can be negotiable. Please provide responses and justifications accordingly.

52. Background: Can the Government please provide the scope of the Case Launcher product prototype? How it is similar/different to the scope in this CSO?

Answer: The Case Launcher prototype will provide functionality to: Initiate a case; Create, edit, task, and price case lines; Review and enter cases. In contrast, the scope outlined in this CSO focuses specifically on the Training Module.

53. Beyond the workflow and task management features described in the AOI, can the Government identify any additional Case Launcher prototype capabilities currently planned or envisioned? This will help industry define appropriate integration boundaries for work performed under this AOI and prevent overlap with existing or emerging functionality.

Answer: The Case Launcher prototype capabilities will provide functionality to: Initiate a case;

Create, edit, task, and price case lines; Add and edit IA Case Notes; Review and enter cases.

Splash page showing assigned tasks and priority cases are included in the Case Launcher prototype. No additional capabilities are planned. Creation of Amendments and Modifications of cases are out of scope. Creation of MTDS pricing is also out of scope.

54. Can the Government specify the anticipated number of down-selects for Phase 1 (Solution Briefs)? Understanding this helps industry scope solutions and teaming strategies appropriately.

Answer: Decision will be taken based on Phases outlined in AOI.

55. Does the Government anticipate making a single prototype award or multiple awards under this AOI? Understanding this helps industry scope solutions and teaming strategies appropriately.

Answer: There may be the ability to award multiple agreements under this CSO/AOI.

56. Will any Government‑furnished tools, platforms, or software (e.g., AWS services, DevSecOps tools, etc) be provided to support CDM pilot development? This ensures respondents do not price or engineer capabilities the Government intends to supply."

Answer: No, offerors should plan to provision.

57. Can the Government specify Business Process Reengineering (BPR) efforts recently completed or in progress related to Case Lifecycle (or other workflows) under the CPIB or other relevant groups? If so, can the Government share any of those process maps or user stories? This will help industry understand where workflow stability exists today and where flexibility may be required in CDM solution design.

Answer: Further details and requirements will be shared with vendors during the appropriate phase of the project. Vendors will also have the opportunity to propose enhancements or modifications to meet mission needs effectively.

58. Will the Government provide development, test, staging, and production environments for the CDM prototype, or should offerors plan to provision interim environments? This will enable accurate estimation of environment setup and support activities.

Answer: No, offerors should plan to provision.

59. Can the Government provide the Case Launcher prototype’s technical architecture, including its technology stack, available APIs, and expected output artifacts? This information is needed to design CDM for proper interoperability."

Answer: Further details and requirements will be shared with vendors during the appropriate phase of the project.

60. Can the Government confirm that successful prototypes shall be deployed within an IL5 environment with commensurate ATO? Understanding this help industry appropriate scope prototype capabilities and determine those solution features that will produce the greatest value for the Government.

Answer: Government will decide the course of action at the appropriate phase of project.

61. Does DSCA/DoW have any platform constraints (preferred enterprise platforms/tools) for the Case Lifecycle system, or are commercial platforms acceptable as long as outcomes are met?

Answer: As outlined in AOI

62. For the document repository, is the expectation a true enterprise repository (records/retention/audit) vs. “case attachments + metadata”?

Answer: True enterprise repository.

63. What does “interim compatibility with a to-be-retired database” mean in practice (read-only sync, bi-directional, batch vs near real time)?

Answer: Read/write to legacy database. Consolidation to be executed once legacy functionality is completed in modernized application and legacy application can be decommissioned. Offeror may propose other, innovative solutions.

64. What are the required data exchange + reporting interfaces and consumers (what systems, what data products)?

Answer: Systems for Integration:

o DSAMS (Defense Security Assistance Management System) o CTS (Case Tracking System).

o Workflow Management Systems: To support tasking and approvals.

o Document Repositories: For secure document storage and retrieval.

o Financial Systems: For pricing, billing, and financial reconciliation (e.g., Defense

Integrated Financial System (DIFS), Defense Agencies Initiative (DAI), Defense Enterprise Accounting and Management System (DEAMS), General Fund Enterprise Business System (GFEBS) or other Foreign Military Financing

(FMF).

o IA Execution Systems for requisitions and delivery (e.g. Centralized Integrated System – International Logistics (CISIL) Foreign Militay Sales – Army Case Execution System (FMS-Aces), Case Management Control System (CMCS), Case Tracking, Requisition, Accounting, Collaboration (CaseTRAC), Management Information System – International Logistics (MISIL), SEA Services Security Assistance Logistics & Execution (S3ALE),Student training systems such as Security Cooperation Training management System SC-TMS

• Reporting Data Products:

o Standardized reports for case lifecycle metrics (e.g., case initiation, tasking, and completion timelines).

o Financial reports, including cost breakdowns and billing summaries.

o Compliance and audit reports to ensure adherence to regulations.

o Customizable dashboards for real-time monitoring and analytics.

o Highly formatted reports to produce official Letters of Offer and Acceptance to be signed by foreign partners.

• Further details and requirements will be shared with vendors during the appropriate phase of the project.

65. For CI/CD + IaC + SBOM/body-of-evidence, what artifacts/standards do they expect (and for which components)?

Answer:

All Components should have:

• CI/CD pipelines, written in a declarative manner, which perform the build, test, release, and deployment of software.

• IaC, leveraged by the pipeline, to perform automated deployment of the software into DSCA's AWS cloud environment.

• SBOM and Software Cybersecurity Artifacts:

o DSCA is seeking proposed SBOM and Software Cybersecurity Artifacts approaches.

o SBOM and cybersecurity artifacts should be generated by the CI/CD or another declarative pipeline.

• Please refer the IM&T technical standards for more information.

66. What is DSCA’s system-of-record for official documents today (SharePoint/M365, an ECM, something else), and is it mandated?

Answer: CTS serves as system of record for the Case Package. No true system of record currently exists for individual component of the Case Package, nor the full scope of documents in scope for the document repository.

67. Do they need records scheduling / retention labeling / eDiscovery for case lifecycle documents (i.e., true records management), or is the repository primarily operational storage?

Answer: Yes true records management system.

68. What is the required hosting/security boundary (tenant/IL/data handling) for the repository and integrations, given the AOI’s emphasis on compliance and ATO acceleration?

Answer: The required hosting and security boundaries for the repository and integrations must align with the following considerations:

1. Impact Level (IL):

o The system must comply with DoD Impact Level 5 (IL5) or higher, depending on the sensitivity of the data being handled.

2. Tenant Structure:

o A multi-tenant architecture is acceptable if it ensures strict data isolation and meets compliance requirements. Alternatively, single-tenant architecture may be preferred for enhanced security and control.

3. Data Handling:

o All data must be handled in compliance with DoD and federal regulations, including NIST 800-53, DFARS, and CMMC requirements.

o Encryption must be applied for data at rest and in transit, using FIPS 140-2 validated cryptographic modules.

4. Hosting Environment:

o The repository and integrations must be hosted in DSCA DISA cloud hosting.

o The hosting environment must support rapid Authority to Operate (ATO) processes, leveraging reciprocity or pre-approved baselines where possible.

5. Integration Security:

o All integrations must use secure APIs and adhere to Zero Trust principles, ensuring least privilege of access and continuous monitoring.

o The system must support audit logging and monitoring to detect and respond to potential security incidents.

6. Compliance and ATO Acceleration:

o The solution should leverage existing compliance frameworks and pre-approved components to streamline the ATO process.

o Vendors are encouraged to propose solutions that minimize the time and effort required to achieve ATO while maintaining full compliance with DoD security standards.