AFLCMC Data Operations Commercial Solutions Opening

AFLCMC Data Operations CSO 1.0 Overview This Commercial Solutions Opening (CSO) is intended to be a streamlined vehicle to allow for the establishment of a modern Data Operations (DataOps) solution supporting a variety of critical national security systems. This CSO authority is established under section 803 of the National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2022 (Pub. L. 117-81) and Class Deviation 2022-O0007. The Air Force Life Cycle Management Center (AFLCMC) programs require the utilization and leveraging of the latest technology advances from a large variety of prospective Contractors. AFLCMC invites innovating technical approach proposals addressing all aspects of DataOps focusing on the below objective areas. However, these enumerated focus areas are minimum requirements, and AFLCMC is open to the identification of technologies useful for modernizing DataOps for sophisticated security and weapon systems. This requires delivering an enduring, secure, robust, efficient, responsive, agile, elastic, and extensible classified DataOps solution. This CSO will focus on existing and emerging technologies and platforms across AFLCMC, Department of the Air Force (DAF), Department of Defense (DoD) and the Intelligence Community, as well as leveraging commercial markets to perform an integrated analysis of the capabilities of varying technologies that support our critical national security systems and prioritize investments over time. The CSO may result in the award of FAR Part 12 Contracts or Other Transaction Agreements (OTAs) under 10 USC 4022, through Calls via Amendments to the CSO. The Government anticipates future Calls to be competitively solicited. These Calls will contain specific Areas of Interest, User Stories and/or Problem Statements related to program specific DataOps Focus Areas. These specific Areas of Interest are what prospective Contractors shall focus their solutions towards. The Government reserves the right to issue separate Calls for each DataOps Focus Area or combine several Focus Areas under an individual Call. Disclaimer: No proposals or white papers are being requested at this time. Those will be requested via Calls published under the CSO solicitation. AFLCMC is not obligated to make any awards from any publicized Call, and all awards under this CSO are explicitly subject to the availability of funds and successful negotiations. The Government is not responsible for any monies expended by any vendor prior to the issuance of any awarded contract/agreement. AFLCMC reserves the right to modify the solicitation requirements of this CSO and each subsequent Call at its sole discretion. This CSO seeks to fund innovative technologies that propose new solutions to expand AFLCMC’s capabilities as it relates to modern DataOps Focus Areas. AFLCMC is interested in capabilities from all interested vendors to include, but not limited to, traditional defense contractors, nontraditional defense contractors, large businesses, small businesses, and research institutions (collectively referred as vendors). It should be noted, many of the critical national security systems operate in varying classification environments, including highly classified environments – such as collateral, Sensitive Compartmentalized Information, and Special Access Program. Though some DataOps Focus Areas may require unclassified work, respondents should be aware that vendors cleared to work, or the ability to be cleared to work, in highly classified environments will be necessary for any award. The CSO is a streamlined acquisition process that seeks to reduce acquisition timelines and acquire new, innovative solutions that vendors can bring forth to meet the stated Areas of Interest detailed in each Call. 2.0 DataOps Technology Focus Areas AFLCMC is seeking capabilities to prove out end-to-end DataOps for representative modern embedded weapon systems. The desired end-state is a DataOps capability/prototype that enables a weapon system to exploit data across the full lifecycle of an embedded weapon system (development, integration, test, deployment, operations and sustainment) across all classification levels. An ideal partner has first-party ability to directly modify underlying commercial hyperscale and edge cloud fabric to meet the project’s requirements across all classification levels and supporting partners would be considered as enabling providers supporting specific aspects of the potential solution. Each Technology Focus Area identifies an area where prospective vendors can bring substantial value to meet the DataOps mission. These focus areas are meant to be read expansively and are not limited to the enumerated Focus Areas. Additional Focus Areas may be included via amendments to this CSO. AFLCMC prefers to bucket several Focus Areas into singular Calls, which means vendors that can optimize several Focus Areas will be preferred. AFLCMC requires provider(s) to deliver an innovative state-of-the-art commercial solution that innovates all or some of the following capability areas. Whether using a single vendor or using multiple vendors, AFLCMC’s intended Minimum Viable Product (MVP) should contain the following Six Foundational Attributes: 1. Hybrid Cloud IaaS, PaaS, SaaS: AFLCMC seeks solutions for Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (Saas) that can be hosted in a hybrid cloud architecture. For the purposes of this CSO, “hybrid cloud” is defined as: a virtual environment provided to a single customer that combines private cloud compute, storage, and services running on-premises with compute, storage, and services running in a public cloud along with the ability to move information seamlessly and transparently between them. All offerings will be templated, extensible, and elastically scalable on converged and/or hyperconverged infrastructure. All offerings will support “bring your own ‘X’,” such that AFLCMC can re-host existing workloads without interruption. All offerings will comply with relevant Department of Defense instructions, regulations, and policies such that they will be readily accreditable and interoperable with existing DoD networks and information systems at the Unclassified, Secret, and Top-Secret classification levels. Additionally, all offerings will be accredited or readily accreditable to handle Special Access Program (SAP) and Sensitive Compartmented Information (SCI) handling caveats at the Secret and Top-Secret classification levels. 2. Information Transport AFLCMC is seeking solutions for information transport that complies with relevant Department of Defense instructions, regulations, and policies such that any transport solution offering will be readily accreditable and interoperable with existing Department of Defense Information Networks (DODIN). Information Transport offerings will also be required to interoperate with the hybrid IaaS, PaaS, and SaaS solutions offered under technology focus area (1). All Information Transport offerings must operate in multi-level classification environments, enabling multi-modal connectivity from anywhere in the Continental United States (CONUS) via a high-bandwidth/low-latency transport solution. Cryptographic transport shall meet National Security Agency (NSA) Type 1 encryption products or equivalent cryptographic solutions. Further, AFLCMC requires capability to support edge resources to operate in disconnected, intermittently connected or low-bandwidth (DIL) environments. Initial connectivity shall encompass Wright-Patterson Air Force Base (AFB), Edwards AFB, Tinker AFB and an off-base facility in the Dayton, Ohio greater metropolitan area. 3. Fielding Operations AFLCMC is seeking solutions to rapidly deploy the solutions acquired under focus areas (1) and (2). To support our system program offices, AFLCMC desires rapid “full network/crypto” deployability to new locations within 30 days from award. Connections should include all enterprise capabilities such as NIPR, SIPR, JWICS, existing classified, SAP capable, hyper-elastic cloud regions and other program networks. Moreover, AFLCMC seeks automated disaster recovery functionality to support Continuity of Operations (CoOPS). 4. Crypto-Net Managements/Commercial Solutions for Classified AFLCMC requires innovative commercial products to be used to protect classified data, including both data-in-transit (DIT) and data-at-rest (DAR). To the maximum extent practicable, technologies for AFLCMC shall be procured in accordance with requests Commercial Solutions for Classified (CSfC) services to comply with the Committee on National Security Systems Policy (CNSSP) No. 11, National Policy Governing the Acquisition of Information Assurance and IA-Enabled Information Technology Products.” 5. Network Operations Center (NOC) / Security Operations Center (SOC) AFLCMC is seeking solutions to support, enable, and augment network administration and cybersecurity operations for solutions acquired under focus areas (1) and (2). Solutions will include services that enable real-time and near real-time metering, auditing, logging, monitoring, and status reporting of the entire virtual environment. 6. Help Desk AFLCMC requires a customer support help desk to assist end-users in navigating, utilizing and accessing data within the cloud environments. AFLCMC envisions a software-as-a-service that can manage all communication and network channels, establish performance metrics and monitoring, and is maximally available to meet mission requirements. AFLCMC is interested in additional focus areas beyond the above six (6) Foundational DataOps focus areas. AFLCMC may issue Calls against the below supplemental focus areas. These supplemental focus areas are meant to be read expansively and not limited to the enumerated areas. Additional Focus Areas beyond those enumerated below may be included via an individual Call against this CSO. Vendors that meet some or all the above Focus Areas may also identify capabilities for the additional focus areas. I. Secure Access Service Edge AFLCMC has a requirement to provide consistent, fast and secure access to dispersed end users operating in permanent military installations as well as forward operating base. Services should establish identity-driven security compliant with US Government security parameters for all classification levels (Unclassified, Secret, Top Secret and SAP programs). II. Software-Defined Networking (SDN) AFLCMC has a requirement to explore implementing SDN for fully networked Command, Control and Communications (C3) functionality, particularly in day-to-day Military Operating Base (MOB) and sustainment missions. SDN should contain a high degree of network programmability and reconfigurability to meet the needs of different government systems and emphasize advantageous situational awareness for faster response times. Further, AFLCMC is interested in other ways SDN can be applied to military environments while preserving data security. III. Edge Hyper-Converged Infrastructure AFLCMC anticipates migrating away from discrete, hardware-defined systems toward software-defined environments permitting all functionality through commercial service platforms while protecting data at all classification levels (unclassified, secret, top secret, SAP). IV. Zero Trust Architecture Given the security posture of many programs, AFLCMC requires zero trust security architecture by “never trusting, always verifying” network security. AFLCMC desires strong identity verification, validation of device compliance before granting access and ensuring least privilege access. V. Infrastructure as Code (IaC) Infrastructure as code is the process of managing and provisioning computer data centers through machine-readable definition files, rather than physical hardware configuration or interactive configuration tools. AFLCMC seeks partners who would be able to expedite the onboarding process for new players by inflating an IaC instance within a cloud environment, enabling immediate executability of licenses, cloud resource management, and other capabilities. VI. Cloud Native Design On-premises (on-prem) infrastructure comes with an immense number of limitations as well as a high threshold for entry for new players in terms of hardware investments and schedule lead times. Utilization of cloud native designs for all network mapping, tooling, IaaS, etc. is of extreme interest to AFLCMC. VII. Software defined perimeter enabling classified data processing AFLCMC participates in work ranging from CUI all the way up to TS/SAR/SCI. Having cloud native, logically defined perimeters around separate enclaves that exist at various classification levels is critical to mission success. Organizations should be prepared to provide a body of evidence to demonstrate logical controls that safeguard information at different impact levels (ILs). VIII. Augmented and virtual reality capabilities (e.g., training, maintenance, etc.) AFLCMC requires commercial augmented and virtual reality capabilities to assist USAF maintenance and service technicians to interface with USAF systems. Applications should have practical maintenance applications as well as training capabilities. IX. Data Encryption (at rest, in motion, FIPS 140-3) Experience with encrypting and safeguarding data is critical to DoD success and cybersecurity. FIPS 140.3 is the standard that shall be used in designing and implementing cryptographic modules that federal departments and agencies operate or are operated for them under contract. The standard provides four increasing, qualitative levels of security intended to cover a wide range of potential applications and environments. The security requirements cover areas related to the secure design, implementation, and operation of a cryptographic module. These areas include cryptographic module specification; cryptographic module interfaces; roles, services, and authentication; software/firmware security; operating environment; physical security; non-invasive security; sensitive security parameter management; self-tests; life-cycle assurance; and mitigation of other attacks. Organizations with familiarization and expertise with establishing and maintaining compliant data encryption could be of use to the DoD. X. Cyber, Secure Processing Due to the sensitive nature of the USAF mission, the ability to leverage cyber secure processing, compliant with DoD standards for all impact levels is required. XI. Machine Learning (ML) and Artificial Intelligence (AI) data factories AFLCMC seeks to find new and innovative ways to deploy and enable AI/ML to identify areas of interest within large data sets. These data factories should be able to pinpoint concerns, operational or safety threats, and shall help alleviate Human in the loop (HITL) man hours currently required to analyze data sets. XII. Big Data capability (data warehousing, data lakes, restructured data engineering) Test sets drive a requirement to capture, transport, and analyze massive amounts of data in near-real-time, as well as a requirement to host portions of that data for an indefinite amount of time. AFLCMC has interest in organizations that have experience with long-term data lakes, and data storage with the ability to enable petabyte and exabyte transport at high speeds between various CONUS and OCONUS locations. XIII. Continuous Integration (CI)/Continuous Development (CD) software pipeline AFLCMC utilizes a DEVSECOPS framework for many of its projects. CI/CD pipelines enable ALFCMC to adapt to emerging threats. Entities with experience in optimization and automation of CI/CD pipelines would be of particular use to the DoD. XIV. Application Development + application refactoring for cloud deployment AFLCMC sees a future use case of being able to pull data developed from another DoD organization to be easily digested and absorbed from a cloud environment and then re-tooled to meet mission requirements. AFLCMC requires a cloud-based platform to host both the outputs of application development (IE app store) as well as a toolkit to refactor an applications targeted use. XV. Existing capability refactoring/integration for Application Programming Interface (API) microservice architecture AFLCMC has a potential future requirement to establish a microservice architecture to iteratively build new applications/capability without impacting availability of systems. AFLCMC requires microservice refactoring within designated cloud-based platforms. XVI. Reverse Engineering AFLCMC has a potential future requirement for reverse engineering services. In instances where AFLCMC lacks sufficient engineering data for varying aircraft or supporting system parts, AFLCMC desires the ability to conduct reverse engineering services to produce underlying engineering data necessary for alternate sourcing of parts or manufacturing of the parts. XVII. Additive Manufacturing AFLCMC desires additive manufacturing services with the capacity for potential on-premises manufacture of varying parts. AFLCMC seeks commercial application of 3d printers and other technologies that permit immediate production of parts to reduce mission incapable awaiting parts (MICAP) status of critical systems/assets. 3.0 CSO with Calls This CSO is a hybrid solicitation against which both Closed Calls and/or Open Period Calls can be published via amendments to the CSO. All Calls issued under this CSO will include specific instructions including dates, Areas of Interest/Focus Areas, evaluation criteria and proposal instructions to offerors. While each offer shall adhere to this CSO, the Calls may contain other information of which the proposing vendors should also strictly adhere. Each Call will be announced on the Government Point of Entry (beta.SAM.gov), which may result in the award of a FAR Part 12 contract or an Other Transaction Agreement (OTA) under 10 USC 4022. 3.1 Closed Calls (One-Step or Two-Step) Over the period of this CSO, Calls may be issued to request white papers and/or proposals for specific Areas of Interest/Focus Areas. It will be determined on a Call-by-Call basis whether the announcement is for a one-step (proposals only) or a two-step process (White Paper first, then Proposals by invite-only). The submission for white papers and proposals shall be submitted at a specific date and time as set for in each particular Call. White papers and/or proposals may not be reviewed if submitted after the stated date and time. 3.1.1 One-Step Calls Step 1: Proposal due date and time will be provided in Calls issued against this CSO. AFLCMC will make selections from vendor proposals only in accordance with the evaluation criteria contained in the Call. 3.1.2 Two-Step Calls Step 1: White Paper due date and time will be provided in Calls issued against this CSO. AFLCMC, at its sole discretion, may or may not request a presentation or discussion with Government personnel about the White Paper. Step 2: Proposal due date and time will be provided in Requests for Proposal (RFPs) sent to offers that submit White Papers who are evaluated favorably in accordance with the evaluation criteria contained in each Call. 3.2 Open Period Calls (Two-Step) This CSO may also have Open Period Calls. Open Period Calls will only be issued under a two-step process (see 3.1.2 above). After an Open Call is published, white papers may be submitted at any time during an Open Period for the Areas of Interest/Focus Areas detailed within the Call. It is important to note that only white papers submitted in response to specific Areas of Interest/Focus Areas detailed in the Call will be considered. Step 1: White Paper due date and time will be provided in Calls issued against this CSO. AFLCMC, at its sole discretion, may or may not request a presentation or discussion with Government personnel about the White Paper. Step 2: Proposal due date and time will be provided in Requests f