CSO Call 003 TRANSCOM "Medical" Regulating and Command & Control Evacuation System (TRAC2ES)

Questions & Answers / Clarifications

This document provides clarifications and answers to questions submitted by potential offerors regarding the USTRANSCOM Information Technology (IT) Enterprise Modernization (ITEM) Solutions, specifically concerning the Transportation Command "Medical" Regulating and Command & Control Evacuation System (TRAC2ES) Call 0003.

• Agile Implementation: The government requires formal SAFe implementation with ARTs and PI Planning, but clarified that the current agile maturity level is Team-Level Scrum.

• Application Development: The requirement is to enhance and extend existing TRAC2ES web and mobile applications, with the mobile application supporting a subset of mission-critical capabilities tailored for operational and DIL environments. New application development is based on current requirements.

• Mobile Platform: The mobile application will work on both iOS and Android. DoD Mobility Unclassified Capability (DMUC) is transitioning to INTUNE. The mobile application is a software-only solution, and end-users must provide their own hardware.

• Support Model: TRAC2ES contractor handles all initial calls at Tier II, escalating to Tier III as required, as there is no dedicated Tier I support. Tier 2 average is 263 tickets (mostly account administration), and Tier 3 is 4.5 tickets (software or BI reports).

• Cloud & Security: The architecture will be cloud-agnostic, supporting AWS and Azure at IL2-6. SECRET deployment is required at award. Offerors must comply with IL2-IL6, RMF, and Zero Trust requirements. The government holds unlimited rights to the current TRAC2ES codebase and database design.

• MVP Definition: The Minimum Viable Product (MVP) will be defined during the 60-day transition period and will include sustainment of the current TRAC2ES code and agreed-upon features. The MVP is expected to deliver operational value within 30 days of award.

• Submission Requirements: Times New Roman font (>=12pt) is required for all text. CUI should be transmitted securely, such as via DOD SAFE. The Rough Order of Magnitude (ROM) estimate should be included within the White Paper submission.

• The due date for Phase I submissions was extended to April 1, 2026.

• Clarifications impact technical approach, development strategy, support structure, and submission content.

Questions & Answers / Clarifications

This document provides responses to vendor questions regarding the USTRANSCOM Information Technology (IT) Enterprise Modernization (ITEM) Solutions, specifically concerning the Transportation Command "Medical" Regulating and Command & Control Evacuation System (TRAC2ES).

• Agile Implementation: The government requires formal SAFe implementation with ARTs and PI Planning, but clarified that team-level Scrum is the current agile maturity level.
• Application Development: The requirement is to enhance and extend existing TRAC2ES web and mobile applications, with the mobile application supporting a subset of mission-critical capabilities tailored for operational and DIL environments. It will work on both iOS and Android.
• Support Model: TRAC2ES contractor handles all initial calls at Tier II, escalating to Tier III as required, with no dedicated separate Tier I support.
• Cloud & Security: The solution must be cloud-agnostic (AWS and Azure support) and comply with IL2–IL6, RMF, and Zero Trust requirements. A SECRET deployment is required.
• Mobile Capabilities: The mobile application will be a single application with different functions, supporting both Android and iOS. It is intended for use by Medical Flight Crews, Aeromedical Evacuation Liaison Teams, and Aeromedical Staging Facilities.
• MVP Definition: The Minimum Viable Product (MVP) will be defined during the 60-day transition period and will include sustainment of the current TRAC2ES code and agreed-upon features.
• Data Rights: The government holds unlimited rights in the current TRAC2ES codebase and database design, and the winning contractor will receive all code.
• CUI Submission: Offerors are encouraged to use secure transmission methods like DOD SAFE for submissions containing Controlled Unclassified Information (CUI).

These clarifications provide essential details on technical requirements, development approaches, security protocols, and support structures, directly impacting how vendors should prepare their proposals and technical solutions.

Solicitation / RFP / RFQ

This Commercial Solutions Opening (CSO) Call 003, "TRAC2ES Enhancement, Sustainment, and Modernization," is issued by USTRANSCOM for IT Enterprise Modernization (ITEM) Solutions. The objective is to find innovative solutions to enhance, sustain, and modernize the Transportation Command "Medical" Regulating and Command & Control Evacuation System (TRAC2ES). TRAC2ES is a critical system for global patient movement, integrating medical regulating, patient evacuation, and command and control decision support, handling sensitive PII and PHI across classified and unclassified environments.

• Enhance, sustain, and modernize TRAC2ES, addressing scalability, performance, cybersecurity, interoperability, and operational efficiency.

• Develop options for transitioning TRAC2ES functionality to a secure, user-friendly mobile application.

• Ensure compliance with Department of War (DoW) standards, including Zero Trust (ZT) principles.

• Deployable across UNCLASSIFIED and SECRET environments, supporting multi-cloud platforms (Azure, AWS) at impact levels 2-6.

• Align with agile methodologies (CI/CD).

• Implement Agile methodology for continuous improvement.

• Migrate TRAC2ES to a secure, cloud-agnostic environment using containerization and serverless computing.

• Establish robust CI/CD pipelines.

• Integrate AI-powered tools for development automation.

• Engineer Zero Trust Architecture (ZTA) with advanced ICAM and micro-segmentation.

• Automate security compliance (RMF, STIGs).

• Employ advanced encryption and data-centric security for PII/PHI.

• HIPAA compliant as a Business Associate.

• CMMC Level 2 self-assessment compliant.

• Leverage AI/ML for optimizing patient movement and resource allocation.

• Provide scalable, API-first architecture for real-time data exchange with systems like DEERS, MEIS, OMDS, and ADVANA Pegasus.

• Deliver advanced Business Intelligence (BI) tools.

• Design for horizontal scalability to support 8,000 concurrent users with 99.3% availability.

• Develop secure, user-friendly mobile applications for disconnected/intermittent/low-bandwidth (DIL) environments.

• Provide a modern, flexible training program.

• Establish and operate a 24/7/365 global Tier II/III Service Desk.

• Contract Type: FAR-based contract.

• Period of Performance: June 1, 2026, to May 31, 2031 (12-month base + 4 12-month option periods).

• Estimated Value: $27,000,000 to $37,000,000.

• Phase I Submissions: White paper and associated PowerPoint briefing, Rough Order of Magnitude (ROM), Firm fixed pricing model.

• Submission Deadline: Solution Briefs Due 10:00 AM (CT) on March 26, 2026.

• Questions Due: 10:00 AM (CT) on March 19, 2026.

• Evaluation: Based on comprehensive, integrated solutions addressing AoI attributes. Generic capability statements and partial solutions will not be evaluated.

Not specified.

• Reference TRANSCOM25CSO001, Attachment 1 (Phase I – Documentation Submission Requirements), and Attachment 2 (Technical Data Package - requires NDA).
• Solutions should be mature, with a minimum viable product deployable within 30 days of award.
• Partnerships and teaming arrangements are encouraged.
• Governing Guidelines and Directives are provided for reference but alignment with every directive is not a requirement.
• Award is subject to funding availability.

Form / Attachment / Pricing Sheet

This document is a Nondisclosure Agreement (NDA) and Agreement for Reception and Control of Controlled Unclassified Information (CUI). It is designed for interested contractors preparing proposals for United States Transportation Command (USTRANSCOM) contracts, specifically related to the HTC71125QD039 Transportation Command "Medical" Regulating and Command & Control Evacuation System (TRAC2ES) Request for Quote.

• Non-disclosure: Contractors must agree not to disclose CUI to anyone not authorized for access for a lawful Government purpose.
• Scope of CUI: Covers information created or possessed for the Government, including CUI received from the Government or originating from other sources.
• Usage Restrictions: CUI must not be used for non-Governmental purposes or for any Government purpose other than the specified TRAC2ES requirement.
• Security & Control: Obligation to protect CUI from unauthorized disclosure, store it securely, and delete/destroy it upon notification.
• Reporting Breaches: Requirement to promptly report any unauthorized disclosures.
• Time: Obligations apply during access and thereafter while information remains controlled, unless explicitly released in writing.
• Breach Consequences: Violation may result in cancellation of CUI access, civil/criminal sanctions, denial of access to other information, or disqualification from submitting an offer.
• Assignee: Contractor assigns royalties from unauthorized disclosures to the U.S. Government.
• Remedies: The U.S. Government may seek legal remedies to enforce the agreement.
• Severability: Provisions are severable; unenforceability of one does not affect others.
• Other Agreements: Does not nullify other existing NDAs.

This agreement is mandatory for any contractor employee who will have access to Controlled Unclassified Information (CUI) related to the TRAC2ES Request for Quote. Bidders must ensure their employees understand and agree to these terms to protect sensitive information and maintain eligibility for future contracts. Failure to comply can lead to severe penalties, including disqualification from the current opportunity.

Form / Attachment / Pricing Sheet

This document, "Atch 2_TDP.docx", is a Technical Data Package (TDP) File List. It outlines the various documents included in the TDP that will be made available to offerors upon request via DOD SAFE.

The TDP includes a comprehensive list of system and interface control documents, configuration plans, and design descriptions related to the TRAC2ES system. Specific documents listed are:

• System/Subsystem Design Description
• TRAC2ES Access Control Plan
• Administrator Guide
• DEERS Interface Control Document (ICD)
• Security Focused Configuration Plan
• Advanced Analytics ICD
• Database Design Description
• Medical Common Operating Picture ICD
• Mobility Enterprise Information System ICD
• Operational Medical Data Service ICD
• Red Criticality Controls Plan
• Requirements Traceability Matrix
• Security System Plan / Vulnerability Management Plan (VMP)
• Theater Medical Data Store ICD
• Topology

These documents will be provided in either Spreadsheet or PDF format. The versions provided will be the most recent available at the time of request, as these items may change throughout the year.

This TDP file list is crucial for bidders as it details the technical documentation available for review. Understanding the contents of the TDP will help potential offerors assess the technical requirements, scope, and complexity of the opportunity, thereby informing their bid preparation and proposal strategy.

Other / Unclassified

This document lists various governing guidance and directives that are relevant to the SAM.gov opportunity. It includes a comprehensive list of federal regulations, DoD Directives and Instructions, NIST publications, and other standards.

Bidders should review this document to understand the regulatory and policy landscape governing the potential contract. Key areas covered include:

• Security and Compliance: NISPOM, CUI regulations, Information Assurance (IA), Cybersecurity, Risk Management Framework (RMF), Controlled Unclassified Information (CUI), and physical security directives.
• Contracting and Management: Earned Value Management (ANSI/EIA 748E), Work Breakdown Structures (MIL-STD-881C), and DoD Records Management.
• Information Technology: Standards for IT interoperability, cybersecurity, and data sharing.
• Specific DoD Programs: Antiterrorism, Personnel Security, Patient Movement, and Cyberspace Workforce Management.
• Federal Standards: FIPS and NIST publications related to information system security and privacy.

Understanding these directives is crucial for bidders to ensure their proposals and subsequent contract performance will meet all applicable government requirements.