CSO Call 8 - "Project Smiley"

The Air Force Life Cycle Management Center (AFLCMC) is seeking a vendor to perform comprehensive cyber vulnerability assessments of industry vendor networks under Project Smiley, a Commercial Solutions Opening (CSO) Call 8. The contractor will conduct nation-state level adversarial penetration testing on development networks, Controlled Unclassified Information (CUI) networks, and JSIG compliant networks, with each assessment engagement not exceeding 30 days. Personnel must possess minimum Secret security clearances and be capable of working in classified environments, with the contractor required to coordinate directly with vendors and establish Non-Disclosure Agreements. The evaluation will focus on technical experience, security access capabilities, project schedule feasibility, and price reasonableness. Proposals are due by July 1, 2025 at 0900 ET and must be submitted via email to AFLCMC.AFLCMC.DataOpsCSO@us.af.mil.

This opportunity is structured as a full and open competition with no set-aside designation, and there is no incumbent contractor currently providing these services. AFLCMC anticipates awarding a FAR Part 12 Indefinite Delivery Indefinite Quantity (IDIQ) contract for a five-year period, with the applicable NAICS code being 518210 and a size standard of $40.0M. The contractor must be capable of conducting at least four assessments in parallel, with services to be performed at various third-party industry vendor facilities. The primary place of performance is listed as Beavercreek, Ohio, though the nature of the work requires travel to multiple vendor locations for on-site assessments. Key deliverables include contract kick-off presentation materials and detailed reports of findings for each vendor network assessment, complete with mitigation strategies and vulnerability remediation guidance.