AFRL SENTRA TEMPEST Proposal Compliance Review and Gap Analysis

Draft Document Name

input_proposal.docx

Reference Criteria Name

solicitation_text.docx

Call / Solicitation ID

FA2377-25-R-B009 (TEMPEST Call 06 — SENTRA)

Anticipated Instrument

IDIQ with CPFF Completion Task Orders

Key Compliance Attachments Referenced in Criteria

Attachment 3 (SOW Supplemental Requirements); Attachment 8 (Labor Category Mapping); Attachment 9 (Ordering Instructions); Attachment 10 (Labor Rates); Attachment 11 (RAC Estimate); Attachment 6 (Reps/Certs); Model Contract sections/clause H0023

Primary Evaluation Drivers (per criteria)

IDIQ: Technical merit and Cost/Price equal; Task Order: Technical primary, Cost/Price secondary; transition and data rights restrictions considered

Highest-Risk Missing Artifacts (from excerpt)

Signed DFARS 252.227-7017 assertions attachment; explicit DD2345 submission/eligibility confirmation; CDRL/final report commitments; RISC/A007 compliance; Attachment 6 reps/certs completion approach; NIST 800-171 SPRS specifics

Unlimited data rights desired

Call states unlimited data rights desired; restrictions considered in evaluation

Proposal targets unlimited data rights where feasible; minimize restrictions

Covered

None.

DFARS 252.227-7017 identification & assertion attachment

Failure to submit/complete/sign assertions attachment may render offer ineligible; enter “none” if no restrictions

Proposal states it will identify/assert per DFARS 252.227-7017 and provide attachment if restrictions exist

Partial

Does not explicitly commit to providing a signed assertions table attachment with the offer (even if ‘none’). Add explicit: submit signed DFARS 252.227-7017 attachment stating ‘none’ or listing assertions.

High

Previously delivered technical data/software (DFARS 252.227-7028)

Applicable; requires disclosure where relevant

Not addressed

Gap

Add statement about whether any deliverables were previously delivered to Government and how they will be identified.

Medium

COTS license review/acceptability

Model contract: COTS license must be consistent with federal law and acceptable to CO; may raise security/use limitations

Proposal states non-labor may include licenses; does not address license term acceptability or review submission

Gap

Add explicit process: submit license terms to CO for review; avoid restrictive/security-problematic terms.

Medium

Proposal due date/time

Proposal due 18 Feb 2026, 12:00 PM (Noon) ET

States proposal due date/time as 18 February 2026, 12:00 PM ET

Covered

Aligned with call.

Low

DoD SAFE request deadline

Must request DoD SAFE link by 16 Feb 2026, 12:00 PM ET

Mentions DoD SAFE drop-off coordinated with POCs; does not mention requirement to request link by 16 Feb deadline

Partial

Add explicit statement committing to request link by the stated deadline (and include CAGE in email) to avoid admin noncompliance.

Medium

Submission method/process

Email Contracting POCs; include company CAGE; POCs verify JCP; then DoD SAFE drop-off

Mentions DoD SAFE drop-off coordinated with Contracting POCs; does not explicitly state CAGE inclusion / JCP verification flow

Partial

Add explicit process compliance language (email POCs, include CAGE, await link/passphrase).

Low

No classified submittals

No classified submittals will be accepted

States “no classified submittals are accepted” and will comply

Covered

Aligned.

Low

Unrestricted solicitation / foreign participation not authorized

Unrestricted call; foreign participation not authorized due to sensitivity

States U.S. citizens only; TS/SCI and SAP eligibility; export-control/ITAR applies

Covered

Add explicit “no foreign participation” confirmation and flowdown to subcontractors.

Low

Export control eligibility / DD Form 2345 submission

Certified DD Form 2345 required with proposal; SOO and DD254 are CUI and released only to qualified contractors via DD2345/JCP

States Export-Control/ITAR applies; certified DD Form 2345 required

Partial

Does not explicitly state “we will submit approved DD2345 with proposal” or confirm current certification status.

High

DD254 access and compliance

DD254 is CUI; must request via POCs; DD254 governs security requirements

States TS/SCI and SAP eligibility per DD254; will adhere to DD254 requirements

Partial

Does not confirm DD254 has been requested/received; consider adding plan for handling if still pending (e.g., align upon receipt).

Medium

Accounting system adequacy for cost reimbursement

Cost-reimbursement contracts require adequate accounting system

States accounting practices/systems will support cost-reimbursement and audit/oversight

Covered

Consider explicitly stating accounting system is DCAA-auditable/approved if true.

Medium

DPAS rated order awareness (DO rated)

Attachment 6 indicates DO rated order; model contract indicates DPAS DO-A7

Proposal does not mention DPAS compliance

Gap

Add explicit DPAS DO rating compliance and internal procedures to prioritize rated orders.

Medium

Page limits (Tech/Management and SOW)

Tech/Management: 25 pages IDIQ + 25 pages per TO; SOW: 10 pages IDIQ + 5 pages per TO

No page-limit compliance statement provided (proposal text excerpt appears unconstrained)

Gap

Add compliance statement and ensure final submitted files meet limits.

High

Subcontracting plan threshold

If effort exceeds $900,000, subcontracting plan required in business proposal (small business exempt)

OCI section mentions subcontractor flowdowns, but no explicit subcontracting plan discussion

Gap

If not small business, ensure required FAR/DFARS subcontracting plan is included; if small business, state exemption.

High

Evaluation structure acknowledgment

IDIQ review: Technical and Cost equal; TO review: Technical primary, Cost secondary; must be “Selectable” for both

Proposal broadly addresses approach and cost realism; does not explicitly map to criteria

Partial

Add explicit crosswalk to evaluation factors (technical merit elements + transition + cost realism).

Low

US citizenship for base/network access

Non-U.S. citizens not allowed for access; green card not sufficient; waivers must be in writing by CO

States U.S. citizens only; personnel are U.S. citizens; TS/SCI and SAP eligibility

Covered

Add explicit acknowledgement that green card is not sufficient and waiver process is CO-written approval if any edge cases arise.

Low

Verify Cognizant Security Office info current with DCSA

Offerors must verify CSO info current with DCSA

States they will maintain current CSO info with DCSA as required

Covered

None.

TS/SCI clearance and SAP eligibility

Required; see DD254 and SCI addendum

States TS/SCI and SAP eligibility for personnel

Covered

None.

OPSEC Level I training timeline and annual refresher

Complete Level I OPSEC within 30 days of joining; annual training thereafter

Commits to Level I OPSEC training within 30 days of onboarding and annual refresher

Covered

None.

Report CPI/CTE loss/compromise within 24 hours

Notify Govt program and security office within 24 hours; use secure means; assist investigations

Commits to notify within 24 hours; incident reporting procedures; secure means implied

Partial

Add explicit “secure means (encrypted email/secure call) appropriate to level involved” language to match requirement text.

Medium

AFRL-managed facility prohibitions (no photo/video/live-stream/recording; prohibited devices/networks)

H0023 clause prohibits specified activities and devices; waiver requires written approval by OPSEC coordinator & Security Chief via PM/COR

Commits to comply; waiver requests routed via PM/COR with written approval prior to introduction of controlled devices

Covered

None.

Immediate reporting if prohibited device/activity occurs

H0023 requires immediate written report to PM/COR with courtesy copy to CO

Proposal states incident reporting procedures within 24 hours for CPI/CTE; mentions compliance with site prohibitions; does not explicitly commit to immediate reporting for prohibited device/activity clause

Partial

Add clause-specific immediate written reporting to PM/COR and CC CO when prohibited activity/device violation discovered.

Medium

CAC issuance and installation access controls

CAC and base access requirements in supplemental clauses; provide updated roster within 7 working days of changes; return CACs timely

Proposal mentions CAC issuance processes and installation access controls

Partial

Missing specific timelines (7 working days updates/returns).

Medium

EMS awareness training (within 30 days)

EMS training within 30 days of award/onboarding; provide signature page to PM and EMS coordinator

Proposal mentions EMS awareness training completion within required timelines

Partial

Add explicit 30-day requirement and signature-page submittal steps.

Low

Base support: no-charge; do not incur costs due to nonsupport absent CO direction; facilities not to be purchased without CO approval

Supplemental Requirement 3 and call text provide base support and restrictions

Proposal states comply and ensure no costs incurred due to nonsupport absent CO direction; mentions Government channels for SW/HW

Covered

None.

S&T Protection Plan / Protection Implementation Plan CDRL A008 (if applicable)

If S&T plan called out, contractor must adhere and produce Protection Implementation Plan CDRL A008; report noncompliance promptly

Proposal generally references security management; does not mention S&T Protection Plan or CDRL A008

Gap

Potential missing requirement depending on whether S&T plan is invoked by SOO/DD254/SOW. Add conditional compliance language and readiness to deliver CDRL A008.

Medium

RISC (R&R Senior/Key Person Profile Worksheets) reporting

Initial/annual/ad hoc R&R profiles per CDRL A007; coordinate before access; notify CO within 5 business days of foreign talent program/foreign components info

Proposal does not mention RISC, A007, talent program notification, or flowdown

Gap

Add explicit RISC compliance commitments, timelines, and subcontractor flowdown; high visibility requirement.

High

Aerospace/Astronautical Engineering

10+ years directly related

Aerospace Modeling & Configuration Management Engineer (Senior/SME)

Meets expertise keywords; explicitly states 10+ years

Covered

None.

Electrical/Electronics Engineering

5+ years directly related

EW/Electrical Systems Modeling Engineer

Meets domain keywords; explicitly states 5+ years

Covered

None.

Mechanical Engineering

5+ years directly related

High-Fidelity Software Engineering (Mechanical Systems) Engineer

Maps to coding/testing/config mgmt; explicitly states 5+ years

Covered

Potential minor concern: nomenclature suggests software vs mechanical; ensure resume shows mechanical engineering background as required.

Systems Engineering

5+ years directly related

Digital Systems Engineer (MBSE)

Matches digital engineering/MBSE; explicitly states 5+ years

Covered

None.

MS&A Engineering

5+ years directly related

Modeling, Simulation & Analysis Engineer

Matches; explicitly states 5+ years

Covered

None.

General Engineering

0+ years directly related

General Engineer (M&S/Data/Software)

Matches; explicitly states 0+ years

Covered

None.

Computer Scientist/Software Developer

5+ years directly related

Software Architect/Developer (Simulation Systems)

Matches software architecture/deployment/config mgmt; explicitly states 5+ years

Covered

None.

Analyst

2+ years directly related

Operational Analyst (M&S/Data/EW)

Matches; explicitly states 2+ years

Covered

None.

Physicist

2+ years directly related

Physics Analyst (Kinematics & Performance)

Matches; explicitly states 2+ years

Covered

None.

Statistics/Mathematician

2+ years directly related

Statistician/Applied Mathematician (DoE & Algorithms)

Matches; explicitly states 2+ years

Covered

None.

Submit Attachment 10 (labor categories and rates) with proposal

Contractor shall identify proposed labor categories and labor rates by submitting Attachment 10; used for negotiation; negotiated rates used for all subsequent TOs and RACs

States they will submit completed Attachment 10 with proposal

Covered

Ensure actual Attachment 10 spreadsheet is included and populated for all required FY columns.

High

Use only negotiated labor categories/rates for TOs and RAC estimates

Ordering instructions require use of agreed labor categories and rates

States all task order proposals and RAC estimates will utilize only negotiated labor categories and rates

Covered

None.

Cost realism support

Cost/Price includes realism; for IDIQ equal importance to technical

States basis of estimate narrative tying hours to activities/deliverables and audit-ready tracking

Partial

Need explicit linkage to Government funding phasing/CLIN structure and realism narrative consistent with CPFF completion.

Medium

Provide complete information on previous/ongoing work associated with contemplated acquisition

Clause requires complete information in proposal

Proposal states it will provide complete information in business proposal; mentions firewalls/NDA/access restrictions

Partial

In this excerpt, the actual disclosure list is not present. Ensure business volume includes specific contract names, customers, periods, and nexus to VCL/SENTRA.

High

OCI clause cannot be modified or deleted

Stated in clause

Not explicitly acknowledged

Partial

Optional to acknowledge; ensure no proposal language attempts to condition or alter clause terms.

Low

Flowdown to subcontractors / safeguards

Clause intent: safeguard proprietary info; prevent unfair competitive advantage

Proposal commits to flowdown and equivalent safeguards

Covered

None.

R-01

Offer deemed incomplete/ineligible due to missing DFARS 252.227-7017 signed assertions attachment

Proposal references compliance but does not explicitly include signed table (including 'none')

Medium

High

High

Include a signed DFARS 252.227-7017 attachment with the offer; if no restrictions, enter 'none' and sign/date.

R-02

Offer ineligible or downgraded due to missing DD Form 2345 submission/eligibility confirmation

Proposal notes DD2345 required but does not explicitly commit that approved/current DD2345 will be provided with proposal and used to obtain CUI attachments

Medium

High

High

Add explicit statement: current DD2345 attached; confirm JCP active; state SOO/DD254 requested/received via DoD SAFE.

R-03

Administrative noncompliance on DoD SAFE request deadline or process

Proposal omits explicit requirement to request DoD SAFE link by 16 Feb 2026 noon ET and include CAGE

Medium

Medium

Medium

Add a short compliance paragraph and internal schedule to request link before deadline; confirm CAGE included.

R-04

Noncompliance with RISC / Senior-Key Person profile reporting could delay access or trigger security action

Proposal does not mention CDRL A007 reporting, annual/ad hoc profiles, or 5-business-day foreign talent program notification

Medium

High

High

Add RISC compliance section: A007 initial/annual/ad hoc, coordination before access, 5-business-day notification, subcontractor flowdown.

R-05

Failure to meet CDRL/data item obligations (including final technical report)

Proposal does not explicitly commit to CDRLs/DD1423 items; does not mention final report and LOF reserve requirement

Medium

High

High

Add CDRL management approach; explicitly acknowledge final report requirement and reserve funds practice.

R-06

Cost/price evaluation risk if Attachment 10 is incomplete or rates inconsistent with narrative staffing

Proposal states intent but artifact not shown; CPFF realism depends on complete rate sets by FY

Medium

High

High

Ensure Attachment 10 fully populated for all FYs and labor categories; align BOE, staffing ramp, and funding phasing.

R-07

Site access delays due to missing CAC/EMS timeline commitments and roster update processes

Proposal mentions CAC/EMS generally but not required timelines and admin steps

Medium

Medium

Medium

Add detailed onboarding compliance: EMS within 30 days, CAC roster updates/returns within 7 working days, sponsor coordination steps.

R-08

Potential evaluation downgrade if transition/data rights strategy lacks concrete mechanics

Proposal is strong on intent; limited specifics on rights assertions, COTS licensing, and integration artifacts (ICDs, packaging)

Low

Medium

Low

Add explicit deliverable packaging standards, repository structure, ICD templates, and rights-assertion decision process (including subcontract flowdown).

Task order proposal contents

Technical proposal; cost proposal by labor cat/hours; non-labor rationale; identify Gov property; other requested docs

Proposal discusses RAC estimate content; does not explicitly address standard TO RFP response package contents beyond generalities

Partial

Add explicit compliance statement for TO proposal package elements (esp. Gov property identification).

Low

Do not start TO performance before order issuance

Contractor not authorized to commence performance prior to issuance of Order by CO

States will not commence prior to CO modification for RACs; also states commence performance only upon award and proper authorization

Partial

Explicitly state “no performance prior to CO-issued task order” (not just RAC mod).

Medium

RAC estimate turnaround

RAC estimate due within five (5) business days of receiving request

States will deliver within five business days and references Government-provided format

Covered

None.

Do not start RAC performance before CO mod

Contractor not authorized to commence performance prior to issuance of modification by CO

States they will not commence RAC performance prior to CO modification; internal controls prevent inadvertent execution

Covered

None.

RAC scope ceiling

RACs: several days to several months; funding line no more than $350k per year

Proposal references days to months; does not explicitly acknowledge $350k/year cap

Partial

Add explicit compliance acknowledgment of RAC funding ceiling and internal checks.

Low

Use of RAC Request for Estimate format (Attachment 11)

Government provides Attachment 11; contractor fills estimate tab

Proposal references “Government-provided RAC Request for Estimate format”

Covered

Ensure internal template mirrors Attachment 11 fields (hours/rates, HW/SW/materials line items, totals, signature).

Low

Unilateral order acceptance window

Unilateral orders: failure to reject within 7 business days constitutes acceptance

Not mentioned

Gap

Add acknowledgement and internal review timeline to avoid unintended acceptance.

Medium

Task-order protest limitations

No protest for orders < $35M except scope/period/max value

Not mentioned

Gap

Add awareness statement if desired (optional); not usually required but can prevent misunderstandings.

Low

Prototype software outputs (models, ICDs, algorithms, viewers, run-scripts, MATLAB tools, script tools)

Call deliverables item 3(b); Model contract CLINs 0003/0005 address software

Proposal lists all prototype software outputs including source; documentation for integration; config-controlled baselines

Covered

Ensure packaging matches VCL/IDAL environment constraints (not detailed in excerpt).

Medium

Hardware/STE/materials and Government delivery at conclusion

Call deliverables item 3(c); Model contract CLINs 0002/0006; deliver all hardware and non-consumed materials at conclusion

Proposal commits to deliver hardware equipment and non-consumed materials at conclusion and maintain property accountability

Covered

Add explicit IUID compliance if delivering items meeting thresholds (DFARS 252.211-7003).

Medium

Data items/CDRLs

Call says see Attachment 4 CDRLs; Model contract requires Exhibit A CDRLs per task order

Proposal mentions documentation and integrated deliverables; does not mention CDRLs/1423 explicitly

Gap

Add explicit commitment to deliver all CDRL data items per DD1423 (including final technical report) and manage schedules/approvals.

High

Final Scientific/Technical Report

DFARS 252.235-7011 applies; delivery schedule notes final report even if limitation of funds; reserve funds to ensure final report

Proposal does not explicitly mention final report requirement or reserving funds

Gap

Add explicit compliance: final report delivery, funding reserve practice under LOF, and submission timing.

High

Disclosure of Information (DFARS 252.204-7000 implementation)

SOW Supplemental Req: provide copies 50 days prior to release to CO and PM

Proposal does not address 50-day pre-release submission process

Gap

Add explicit publication/release workflow and 50-day lead time to CO/PM named in supplemental requirements.

Medium

FAR/DFARS reps & certs completion (Attachment 6 + SAM)

Completed reps/certs required for complete offer; some in SAM, some fill-ins; signature attestation required

Proposal excerpt does not mention completion/signature of Attachment 6 or SAM reliance

Gap

Ensure business proposal includes signed Attachment 6 (or clear SAM-based approach) and completes any fill-ins.

High

NIST SP 800-171 DoD Assessment (252.204-7019/7020)

Assessment requirements; completed in SPRS; safeguarding obligations in DFARS 252.204-7012

Proposal acknowledges DFARS safeguarding and NIST SP 800-171 assessment requirements where applicable

Partial

Add explicit statement of current SPRS score/date and plan to maintain compliance; specify handling of CDI/CUI environments.

High

Covered telecom equipment prohibitions (FAR 52.204-24/25; DFARS 252.204-7017/7018)

Requires representation and disclosures if applicable

Not addressed

Gap

Add explicit representations and confirm reasonable inquiry performed; include disclosure only if needed.

Medium

FASCSA orders (FAR 52.204-29)

Requires representation of reasonable inquiry and disclosures if unable to comply

Not addressed

Gap

Add explicit statement that reasonable inquiry conducted and no covered articles/sources will be used, or provide disclosures.

Medium

Cloud computing representation (DFARS 252.239-7009)

Must represent whether cloud will be used

Not addressed (proposal mentions repositories/workflows, not cloud)

Gap

Add explicit “anticipate / do not anticipate cloud computing services” and ensure consistency with solution (e.g., repos, CI/CD).

Medium

PRC workforce disclosure (DFARS 252.225-7057)

If covered entity employs individuals who work in PRC, must disclose use, count, addresses

Not addressed

Gap

Add explicit statement and disclosures as applicable (often “none / not applicable”).

High

Duty-free entry awareness (DFARS 252.225-7013)

Clause anticipated; use to prevent duties

Not addressed

Gap

If importing items, address shipping documentation and duty-free entry compliance; otherwise state not anticipated.

Low