Notice ID: a710b578820f49cda1306226c33d346cSolicitation
CSS3 Request for Proposal
Archived on October 30, 2026. Solicitation posted by DEPT OF DEFENSE (DEPT OF THE AIR FORCE) on February 5, 2026. Solicitation FA872624RB007.
NAICS 541513 (Computer Facilities Management Services). Set-aside: Small Business Set Aside - Total. Place of performance: Hanscom AFB, MA. Original response deadline: . Full description on SAM.gov.
Description
10/30/2024 Final Round 3 Questions and Answers with amended requirement documents. All attachments can be found at the following link: https://piee.eb.mil/sol/xhtml/unauth/search/oppMgmtLink.xhtml?solNo=FA872624RB007 History: 10/24/2024 Solicitation amended to extend Proposal due date prior to the 3rd and final round of Q and A. The Government continues working additional received questions to provide timely answers, so expect the additional round of Q and A as soon as possible. All attachments can be found at the following link: https://piee.eb.mil/sol/xhtml/unauth/search/oppMgmtLink.xhtml?solNo=FA872624RB007
Overview
Agency:
Department of WarDepartment of the Air Force
Office:FA8726 AFLCMC HNK C3IN
Posted:February 5, 2026
NAICS:541513: Computer Facilities Management Services
Last Updated:Sep 25, 2026
PSC:DG01: IT AND TELECOM - NETWORK SUPPORT SERVICES (LABOR)
Response Deadline:
Set-Aside:Small Business Set Aside - Total
Type:Solicitation
Place of Performance:Hanscom AFB, MA, 01731
Award Overview
Possible prior contracts
Sign in to see possible prior contracts for this requirement (matched by agency, NAICS and place of performance; not confirmed).
Contacts
Contracting Officer
Primary Contact
Documents
No documents available.
Lifecycle
Solicitation:
FA872624RB007- Pre-Solicitation
- Solicitation
Award typically follows within 30–90 days after the response deadline. (estimate)
- Pre-SolicitationAug 29, 2024
Synopsis of AFLCMC Cyber Support Services Request for Proposal
- Pre-SolicitationSep 13, 2024
Synopsis of AFLCMC Cyber Support Services Request for Proposal
- 9×SolicitationCurrentSep 16, 2024
CSS3 Request for Proposal
Similar Opportunities
Title | Phase | Agency | NAICS | Set Aside | Posted | Deadline | Location |
|---|---|---|---|---|---|---|---|
Request for Information Multi-X Security (MXS) Platform Operations and Maintenance 15 October 2026 1.0 Description The Air Force Life Cycle Management Center, in support of the Advanced Technology Branch (AFLCMC/HNJT), is seeking information from interested companies with the capability to provide Operations and Maintenance, and continuous modernization of the Multi-X Security (MXS) Platform. 2.0 Background Between 2019 and 2026, the Advanced Technology program office developed the MXS (pronounced “Maxis”) Platform as a modern security model, data model, reference architecture, and reference implementation, based on open standards and protocols to support software development and secure information sharing at multiple security levels. MXS' goal is to enable Protection Level 3 (PL3) software solution development by third-party developers within security-constrained environments, as typically employed by communities working with Special Access Programs (SAPs). 3.0 Description of Requirements 3.1 Scope & Operating Environment: AFLCMC/HNJT requires information on industry capabilities to operate, maintain, and continuously enhance a multi-tenant, cloud-native platform supporting Air Force and mission-partner applications. The platform operates across multiple security enclaves, including Unclassified, Secret//Special Access Required (SAR), Top Secret//SAR, and Top Secret//Sensitive Compartmented Information (SCI)//SAR cloud environments. 3.2 Platform Operations, Maintenance & DevSecOps: Prospective contractors are expected to provide proactive 24/7/365 system availability, platform administration, and lifecycle sustainment across all designated cloud environments. Core focus areas include: 3.2.1 Cloud-Native Infrastructure: Operating and maintaining containerized environments (e.g., Kubernetes), service meshes, Application Programming Interface (API) gateways, and Infrastructure-as-Code (IaC) baselines. 3.2.2 DevSecOps Toolchain: Sustaining an automated continuous integration/continuous delivery (CI/CD) pipeline that enables secure cross-domain software progression. 3.2.3 Telemetry & Resource Monitoring: Providing automated, granular visibility into platform health, microservice performance, compute/storage utilization, and licensing. 3.2.4 Enterprise ICAM & Certificate Services: operate and maintain enterprise identity management infrastructure across multiple tenants. 3.2.5 Managed Database Services, Registered Queries & API Mediation: Provision, sustain, and optimize managed database services across cloud environments, engineer registered and parameterized queries for controlled data access and governance, and diagnose latency or throughput bottlenecks. 3.3 Continuous Platform Evolution: Delivering agile enhancements, feature updates, and technical debt remediation in alignment with government-prioritized backlogs. 3.4 Tenant Enablement & Multi-Tier Support: To support diverse tenant software programs, the platform requires integrated customer enablement services. 3.4.1 Tenant Onboarding and Offboarding: Assisting tenant developer teams with architectural guidance, common control inheritance, and standardized integration toolkits. 3.4.2 Service Desk Operations: Operating a tiered technical service desk (Tier 1–3) providing incident management, troubleshooting, and user assistance across all classification levels. 3.5 Cybersecurity & Continuous Authorization: The platform must maintain a rigorous cybersecurity posture compliant with DoD, Intelligence Community, and SAP directives. 3.5.1 Sustaining existing Risk Management Framework (RMF) Authorizations to Operate (ATOs). 3.5.2 Executing Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST), container vulnerability assessments, dependency assessments (Software Bill of Materials (SBOM), Vulnerability Exploitability eXchange (VeX), etc.), and rapid vulnerability remediation. 3.5.3 Generating and maintaining RMF bodies of evidence and security documentation to maintain inheritance relationships for hosted software and systems. 3.6 Potential Security, Facility, and Personnel Requirements. The Government is conducting market research regarding the availability, timing, and feasibility of contractor personnel clearances, secure facilities, and cybersecurity qualifications that may be required for a future acquisition. The requirements of any future solicitation, including timing and acceptability of facilities, will be established only in that solicitation. 3.6.1 Personnel Clearances: Contractor personnel must possess active Top Secret clearances and applicable DoD 8140 baseline certifications at the time of contract award, with the ability to obtain SCI and SAP access within 30 days of contract award 3.6.2 Secure Facilities: Within 30 days of contract award, the Contractor shall possess and maintain accredited Sensitive Compartmented Information Facility (SCIFs)/Special Access Program Facility (SAPFs), as required to perform the classified development and operational activities under this contract. Each facility shall maintain current written accreditation by the cognizant accrediting authority and comply with applicable requirements of ICD 705, DoDM 5105.21, Volume 2, and DoDM 5205.07. 4.0 Specific Areas of Interest 4.1 Corporate Overview & Business Classification 4.1.1 Entity Identification: State your company name, Commercial and Government Entity (CAGE) code, and business size/socioeconomic status under the designated North American Industry Classification System (NAICS) code. 4.1.2 Contract Vehicles: List the relevant Government-Wide Acquisition Contracts (GWACs), Multiple Award Schedules (e.g., GSA MAS, NASA SEWP, OASIS+), or agency vehicles your organization currently holds. 4.2 Experience & Technical Approach 4.2.1 Relevant Past Performance: Provide up to three (3) examples (within the past 5 years) demonstrating prime or major subcontractor experience operating multi-tenant cloud platforms of comparable scope, complexity, and classification (including Amazon Web Services (AWS)/Azure Secret, Top Secret, or SAP enclaves). 4.2.2 Platform Management & DevSecOps: Describe your experience managing cloud-native infrastructure (e.g., Kubernetes, service mesh, Infrastructure as Code (IaC)) and sustaining multi-fabric DevSecOps pipelines across air-gapped or cross-domain environments. 4.2.3 Platform Software Development Kits (SDKs) & Toolkits: Summarize your experience developing and sustaining SDKs, shared libraries, and developer modules to accelerate tenant application delivery. 4.2.4 Enterprise Identity, Credential, and Access Management (ICAM) & Certificate Services: Describe your experience deploying and sustaining enterprise and external Certificate Authorities (CAs) across multi-tenant and air-gapped environments, including certificate validation and revocation infrastructure (e.g., Online Certificate Status Protocol (OCSP) responders, Certificate Revocation List (CRL) distribution points). 4.2.5 Managed Database Services, Registered Queries & API Mediation: Describe your experience provisioning, optimizing, and troubleshooting cloud-managed database services, including engineering registered and parameterized queries for controlled access and governance. Detail your experience developing middleware, abstraction layers, or gateway adapters for protocol bridging, query translation, and data transformation across disparate APIs. 4.2.6 Protection Level 3 (PL-3) Multi-Level Access Control & Attribute-Based Authorization: Describe your experience engineering and operating applications within PL3 SAR environments to restrict data access to users' explicit clearance and compartment authorizations. Detail your approach to synchronizing identity attributes from Authoritative Data Sources (ADS) and implementing, enforcing, and auditing Role-Based Access Control (RBAC), Mandatory Access Control (MAC), and Attribute-Based Access Control (ABAC) policies using Policy Enforcement Points (PEPs), Policy Decision Points (PDPs), and fine-grained, object-level filtering and data labeling. 4.3 Tenant Enablement & Multi-Tenant Operations 4.3.1 Onboarding & Isolation: Describe your approach to onboarding diverse tenant applications to a shared cloud environment while maintaining strict logical isolation, zero trust boundaries, and zero service interruption to existing tenants. 4.3.2 Training & Enablement: Outline the standard onboarding artifacts, API documentation, and training support that should be provided to tenant engineering teams. 4.3.3 Tiered Technical Support: Describe your operational model for delivering Tier 1–3 service desk and platform support across both unclassified and classified environments. 4.3.4 Service Level Agreements (SLAs) & Operational Sustainment: Describe your recommended Service Level Agreements (SLAs) for the platform, such as uptime/availability targets, incident response and resolution thresholds by severity, performance baselines, and Recovery Time Objective (RTO)/Recovery Point Objective (RPO) across unclassified and classified environments. Detail your operational support model, monitoring tooling, escalation procedures, and staffing strategy to guarantee and report on compliance with these metrics. 4.4 Cybersecurity & Compliance 4.4.1 Continuous Authorization: Detail your methodology for maintaining RMF accreditation. 4.4.2 Security Test Automation: Summarize your approach to code scanning and test automation to include tools, artifacts, processes, and gating criteria within a DevSecOps pipeline. 4.4.3 Security Standards Compliance: Outline your experience implementing JSIG/CNSSI 1253 Rev 5, DoDM 5205.07, Zero Trust Architecture, or any other applicable DoD/DoW requirements. 4.5 Security Clearances & Facilities 4.5.1 Personnel Clearance Readiness: Describe your labor pipeline and ability to provide qualified, certified personnel with Top Secret clearances with eligibility for access to SCI and SAP, and general timelines. 4.5.2 Secure Facility: Confirm whether your organization currently operates an accredited SCIF/SAPF suitable for classified contract execution or has a facility that could be accredited or modified within 30 days of contract award to meet applicable ICD 705 and SAP security requirements within the required contract performance timeline. 4.6 Cost Models, Funding Intake & Contract Structure 4.6.1 Cost Drivers: Identify primary cost drivers for baseline platform sustainment versus new feature development. 4.6.2 Consumption Metering & Showback: Describe your approach to tracking and reporting tenant consumption (compute, storage, service desk) to support customer-funded usage and line-of-accounting showback/chargeback. 4.6.3 Contract Structure Recommendations: Recommend suitable contract types (e.g., Firm Fixed Price, Time & Materials, hybrid) and incentive structures that balance performance, flexibility, and risk. 4.7 Contemplated Gating Strategy Feedback: The Government is contemplating an administrative Pass/Fail Phase 1 gate evaluated on an Acceptable/Unacceptable basis (e.g., verified prime contractor experience of similar scope, active facility clearance/accreditation, and baseline cyber certifications) prior to technical proposal evaluation. The contemplated gating approach is provided solely to obtain market research feedback. The Government has not established final evaluation factors, minimum qualification requirements, acquisition strategy, contract type, or source-selection methodology. Any future solicitation will independently state all applicable requirements and evaluation criteria. 4.7.1 Impact on Competition: Does the proposed Phase 1 gate unduly restrict your organization’s ability to compete as a prime contractor or participate as part of a joint venture/team? If yes, fully explain. 4.7.2 Recommended Criteria: What objective metrics, scope parameters, or dollar thresholds should define "similar experience" to ensure robust, qualified competition? 5.0 Response Interested vendors are invited to submit an unclassified capability statement demonstrating their ability to satisfy Section 3.0 requirements, along with detailed responses to the questions in Section 4.0. Do not include classified or SAP data in the submission. Submissions must not exceed twelve (12) single-spaced, single-sided pages (8.5 × 11 inch, 12-point font). Please send responses to this RFI electronically to the Contract Specialist within thirty (30) days after publication of this announcement. Questions concerning this RFI should be directed to Capt Matthew Gauert via email at matthew.gauert.2@us.af.mil with the subject line “RFI Response - MXS Platform O&M - [Company Name].” Note: only electronic responses will be considered. Respondent’s information shall contain respondent company name; company address; primary point of contact for information provided; and company website address that provides any additional information about the respondent’s company. Respondents shall clearly identify and mark any proprietary or confidential commercial information contained in their submissions. The Government will protect properly identified information from disclosure to the extent authorized by law and regulation. Information received may be used solely for market research and acquisition-planning purposes. Submission of a response does not grant the Government any license or other rights in a respondent’s proprietary information beyond those necessary to evaluate and use the response for those purposes. 6.0 Summary This RFI does not constitute an Invitation for Bids (IFB), Request for Proposal, Request for Quote (RFQ), nor does this issuance restrict the Government’s acquisition approach. Any information received is considered market research and may be utilized by the Air Force in developing its acquisition strategy. This market research will be used to assess the availability and adequacy of potential sources. The Government will not respond or conduct formal or informal briefings to vendors or respondents to this RFI. The Government does not reimburse respondents for any costs associated with submission of information being requested/received, nor reimburse expenses incurred to interested parties for responses to this RFI. THIS RFI IS ISSUED SOLELY FOR INFORMATION AND PLANNING PURPOSES AND DOES NOT CONSTITUTE A SOLICITATION. THE GOVERNMENT DOES NOT INTEND TO AWARD A CONTRACT ON THE BASIS OF THIS RFI, AND RESPONSES TO THIS NOTICE ARE NOT OFFERS AND CANNOT BE ACCEPTED BY THE GOVERNMENT TO FORM A BINDING CONTRACT. RESPONSES TO THIS RFI WILL NOT BE RETURNED. | Market Research | 541513 | No Set-Aside | 10/15/2026 | 11/16/2026 | 0, MA | |
This is an RFI ONLY. See Attached SOW | Market Research | 541511 | Total Small Business Set-Aside | 09/02/2026 | 10/02/2027 | - | |
Kessel Run (KR) is responsible for developing, fielding, and operating mission critical warfighting applications in support of the U.S. Air Force. These applications need to be operationally available and mission capable 24/7/365 in highly contested environments. The Air Operations Center (AOC) Weapon System (WS) is a complex Command and Control system-of-systems comprised of diverse hardware, software, third-party applications, and web services, which require a comprehensive platform, infrastructure, and application integrations strategy. This strategy must address the complexities of maintaining, upgrading, and securing a heterogeneous environment while ensuring interoperability with other Department of War (DoW) systems. Leveraging Government Off-the-Shelf (GOTS) and Commercial Off-the-Shelf (COTS) solutions is a key tenet of the program to expedite integration and deployment. The AOC WS program office relies heavily on third-party providers for mission application development and sustainment. See attached files for additional information. Response Submittal: Interested parties are requested to respond to this RFI with a white paper. Submit either by e-mail to rachel.sullivan.3@us.af.mil and tracey.toombs@us.af.mil or through the DoD Secure Access File Exchange (SAFE) website (https://safe.apps.mil/) to the same email addresses. White papers are due on the response date stated on this announcement. Any information submitted by respondents to this RFI is strictly voluntary. Responses to the RFI will not be returned. Respondents are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the expense of the interested party. Format: White papers must be submitted in Adobe Portable Document Format (PDF) format, compatible with Adobe Acrobat Pro, and in 12-point font (smaller font may be used for figures and tables). White papers shall be limited to 8 pages including all figures, tables, and charts. | Market Research | 541512 | No Set-Aside | 10/05/2026 | 10/14/2026 | - | |
UPDATE: This Industry Day that was planned for 4 November 2026 is now postponed. A new date will be announced at a later time. The attached document has been updated to reflect this change. The Air Force Nuclear Weapons Center’s Nuclear Networks Division plans to conduct an Industry Day in support of the Global Aircrew Strategic Network Terminal Increment 2, Block 2 program, referred to as GASNTi2b2. The purpose of the event is to provide industry with a preliminary overview of the required capability to obtain feedback for market research and acquisition planning. The contemplated effort will involve the design, development, and integration of components to deliver a strategic ground-based High Frequency (HF) communications system. This release serves as an early planning notification; consequently, all scheduled dates and event details remain tentative. The formal, finalized announcement is projected to be published on SAM.gov in approximately October. Please see the attached document for more information. | Special Notice | 541512 | No Set-Aside | 10/02/2026 | 10/30/2026 | 0, MA | |
Kessel Run (KR) is responsible for developing, fielding, and operating mission critical warfighting applications in support of the U.S. Air Force. These applications need to be operationally available and mission capable 24/7/365 in highly contested environments. The Air Operations Center (AOC) Weapon System (WS) is a complex Command and Control system-of-systems comprised of diverse hardware, software, third-party applications, and web services, which require a comprehensive platform, infrastructure, and application integrations strategy. This strategy must address the complexities of maintaining, upgrading, and securing a heterogeneous environment while ensuring interoperability with other Department of War (DoW) systems. Leveraging Government Off-the-Shelf (GOTS) and Commercial Off-the-Shelf (COTS) solutions is a key tenet of the program to expedite integration and deployment. The AOC WS program office relies heavily on third-party providers for mission application development and sustainment. See attached files for additional information. Response Submittal: Interested parties are requested to respond to this RFI with a white paper. Submit either by e-mail to rachel.sullivan.3@us.af.mil and tracey.toombs@us.af.mil or through the DoD Secure Access File Exchange (SAFE) website (https://safe.apps.mil/) to the same email addresses. White papers are due on the response date stated on this announcement. Any information submitted by respondents to this RFI is strictly voluntary. Responses to the RFI will not be returned. Respondents are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the expense of the interested party. Format: White papers must be submitted in Adobe Portable Document Format (PDF) format, compatible with Adobe Acrobat Pro, and in 12-point font (smaller font may be used for figures and tables). White papers shall be limited to 8 pages including all figures, tables, and charts. | Market Research | 541512 | No Set-Aside | 09/29/2026 | 10/14/2026 | - |
Additional Details
Solicitation Number
FA872624RB007
Archive Date
Oct 30, 2026
Office Address
HANSCOM AFB, MA, 01731-2100