GB CAS - Cloud Assessment, Cloud Migration, Cloud Continuous Development, and Cybersecurity

The United States Air Force (USAF) Business Enterprise Systems Directorate is seeking comprehensive cloud and cybersecurity services through an Indefinite Delivery, Indefinite Quantity (IDIQ) contract to modernize, standardize, secure, and enhance its information technology infrastructure, platforms, and mission applications. The procurement encompasses four core service areas: Cloud Assessment, Cloud Migration, Cloud Continuous Development, and Cybersecurity. Key requirements include conducting comprehensive cloud assessments, executing secure cloud migrations of legacy applications, implementing DevSecOps practices, managing vulnerabilities, ensuring compliance with Department of Defense and Air Force cybersecurity frameworks, and providing ongoing security monitoring and risk management. Contractors must be capable of fulfilling critical cybersecurity roles including Information System Security Officer, Information System Security Manager, Information Systems Security Engineer, and Security Control Assessor's Representative. The evaluation criteria for task order awards will be based on a best-value determination considering technical expertise, understanding of USAF requirements, past performance, and proposed cost and schedule. Interested vendors must submit 10-page capability statements by January 29, 2026, to eric.amissah.1@us.af.mil and warren.hodges@us.af.mil.

This pre-solicitation notice is designated as a Competitive 8(a) small business set-aside under FAR 19.8. The contract is anticipated to be awarded on a firm-fixed-price basis with a base performance period of one year, followed by two optional one-year extensions, for a potential three-year period of performance. The Air Force anticipates using Agile methodologies for contract execution and performance measurement. The contract number referenced in the draft Performance Work Statement is FA8771-25-R-0017, and the notice was posted on January 15, 2026, with a response deadline of January 29, 2026. No incumbent contractor or specific award value has been disclosed in the pre-solicitation materials. The NAICS classification is 518210, Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services.