Request for Information FAQs Ammendment 1

SOURCES SOUGHT NOTICE / REQUEST FOR

INFORMATION (RFI)

RFI FAQ’s (AMENDMENT 01)

Notice ID: N00019-26-RFPREQ-WPM281-0281

Title: PMX-281 IT Strategy, Software Modernization, and Digital Decision Intelligence Advisory Subscriptions
Issuing Agency: Naval Air Systems Command (NAVAIR) / PMA-281 Date: November 5, 2026
Question 1:
Does the Government require the commercial research and advisory subscription portal to operate at Department of Defense (DoD) Cloud Computing Security Requirements Guide (SRG) Impact Level 4 (IL4) or higher? Government Response:
No. The Government does not require the commercial research and advisory portal, document repository, or benchmark database to operate at DoD Impact Level 4 (IL4) or IL5.
The primary scope of the subscription is to deliver commercial research, market assessments, technology benchmarks, and analytical toolsets produced and maintained by the commercial provider. Access to this commercial library does not require the Government to furnish Controlled Unclassified Information (CUI). Platforms operating under standard commercial/federal cloud security controls (e.g., SOC 2 Type II, FedRAMP, or equivalent commercial hosting standards) are acceptable for the subscription repository portion of this requirement. Question 2:
How will Controlled Unclassified Information (CUI), export-controlled (ITAR/EAR) data, or classified discussions be managed if the commercial subscription platform is not IL4?
Government Response:
In accordance with Section 4.0 of the draft Statement of Work (SOW), performance requirements are as follows:

1. Commercial Research & Analytical Toolsets: Unclassified, commercially published materials are accessed directly via the contractor's secure commercial web portal.
2. Advisory Inquiries & Technical Engagements: Any advisory interactions, technical roadmapping, or document reviews involving CUI, ITAR-controlled technical data, or classified information will be conducted exclusively via approved Government communication environments (e.g., NMCI, encrypted DoD email) or in-person within Government-accredited facilities (SCIFs at NAS Patuxent River).
Offerors will not store, process, or transmit CUI or classified data on their commercial research platform.
Question 3:
What are the facility and personnel security clearance requirements for this effort? Government Response:
As outlined in SOW Section 4.0 and the accompanying DD Form 254: •

•

•

Facility Security Clearance (FCL): Offerors must possess and maintain a TOP