CSO Call 005 QnA

CSO FA700025SC001 Call 005

Focused Area of Interest: USAFA AI High School Transcript Reading and Scoring Capability Questions and Answers 5 May 2026
Q1:

Are foreign IT companies allowed to team with us for a proposal on this program?

A1:

No. In accordance with the DoD Cloud Computing Security Requirements Guide (SRG),

foreign companies are not permitted to work with Controlled Unclassified Information (CUI), which includes the data processed by this system. All work must be performed by U.S. Citizens. (See clarification in A3 below).
Q2:

Are there Security & Classification Restrictions pertaining to the handling of CUI that might

prevent foreign IT company participation?
A2:

Yes. The system will handle CUI (including PII/PHI). Per the most recent DoD Cloud

Computing SRG, systems processing CUI require U.S. Citizen personnel for development, administration, and access.
Q3:

CLARIFICATION: Does the security requirement for this CUI data permit the use of Lawful

Permanent Residents (Green Card Holders), or is access strictly limited to U.S. Citizens? A3:

Clarification to A1 and A2: While foreign companies and foreign nationals are strictly

prohibited, the government officially defines the personnel requirement for this effort as "U.S. Persons." In accordance with Title 8 U.S.C. 1101(a)(20), a Lawful Permanent Resident (i.e., a "Green Card holder") is legally considered a "U.S. Person." Therefore, U.S. Green Card holders are permitted to own the company, develop, and manage this program. Foreign Persons are not permitted to have access.
Q4:

Will ITAR Certification of the foreign IT companies be required for this project?

A4:

N/A. As stated above, foreign IT companies and foreign nationals are strictly prohibited from

participating in this effort.
Q5:

If using U.S. Persons (including Green Card holders), are there any additional company

security requirements or special authorizations needed to participate? A5:

No special authorizations are required beyond meeting the requirements stated in the Call

document. Standard security and personnel vetting protocols for CUI access will apply. Q6:

Is developing and hosting the software strictly within the U.S. sufficient to meet security

protection requirements?

A6:

No. While U.S.-based development and hosting (with no foreign sharing) is a firm

requirement, the contractor's solution must also meet industry standards for the protection of Personally Identifiable Information (PII) and all necessary security controls for the specified