Market Survey for Software Engineering Services - Seeking Industry Capability Statements from Seaport Small Businesses for NIWC PAC Code 532 Application Arsenal (AA) Enterprise Engineering and Lifecycle Support

Market Survey / Amendment

This is Amendment 0002 to a Market Survey for Application Arsenal (AA) Enterprise Engineering and Lifecycle Support. It is issued for the purpose of assessing Small Business capabilities. Large businesses are instructed not to respond. The government is seeking information on small business firms capable of performing the tasking described, which involves the full lifecycle of systems engineering and software sustainment for the AA platform.

• Scope: Full lifecycle systems engineering and software sustainment for the AA platform, primarily within the Overmatch Software Armory (OSA) DevSecOps pipeline, but potentially other pipelines like ORION.

• Tasks: Planning, development, testing, and integration of new AA releases and enhancements; modernizing deployment architectures; designing secure integration pathways; engineering and integrating cybersecurity controls (RMF standards); fielding new releases across environments (CONUS/OCONUS, ashore/afloat); operations & maintenance (O&M) of fielded releases; system administration (Linux/Windows); cyber and information assurance (IA) support; and help desk support.

• Place of Performance: Primarily Naval Information Warfare Command, Pacific, San Diego, CA.

• Estimated Level of Effort: Approximately 25-30 Full Time Equivalents (FTEs) per year (1,920 hours/FTE).

• Estimated Dollar Range: >$30M - $50M.

• NAICS Code: 541330, Engineering Services, with a size standard of $47.0 million.

• Anticipated Contract Type: Cost-Plus-Fixed-Fee (CPFF).

• Period of Performance: Six (6) years (one (1) base year and four (4) 1-year options).

• Follow-on Contract: For PEOC4I Storefront/Application Arsenal and Navy Net-Centric Application Support.

• Response Page Limit: Not to exceed 10 single-sided pages.

• Formatting: 8.5x11 inch paper, single-spaced, 1-inch margins, 10 point Times New Roman font. Graphics/pictures not allowed; tables/charts count towards page limit.

• Submission: Via email to Corbin Walters (corbin.c.walters.civ@us.navy.mil) with reference number N66001-26-R-3507.

• Closing Date: 11 May 2026, 15:00 PST.

• Questions Deadline: 27 April 2026.

• Required Information: Corporate Description (size status, ownership, POCs, CAGE/UEI, Seaport Contract #, affiliate info, facility clearance, accounting system statement) and Corporate Experience (1-3 citations for relevant experience in specified key areas, using Attachment 2 format).

• Target Audience: Small Business firms only. Large businesses should not respond.

• Subcontracting: If using Similarly Situated Entities (SSEs), the prime must manage the entire contract and not pay more than 50% to non-SSE subcontractors.

• Potential Set-Aside: Government reserves the right to consider a set-aside for small businesses or specific small business groups (8(a), HUBZone, SDVOSB, WOSB, etc.).

• This is for planning purposes only and not a solicitation.

• No reimbursement for costs associated with providing information.

• Responses must conform to MS instructions to be considered.

• Acquisition strategy decision will be posted on SAM.gov after evaluation.

Questions & Answers / Clarifications

This document provides responses to vendor questions regarding the N66001-26-R-3507 opportunity, clarifying aspects of the solicitation and the "Application Arsenal" program.

• Attachment 2 References: Subcontractor performance can be referenced for Attachment 2, but only if the respondent acted as the prime for that specific work. Prime references are required for demonstrating management infrastructure, procurement capacity, and execution/management ability.
• AA Implementation Pain Points: Current challenges include manual testing overhead and complex DDIL environment deployment requirements, highlighting a need for CI/CD pipeline improvements.
• Architecture Flexibility: While environmental and security constraints (edge, networks, Software Factory, DoW cyber compliance) are fixed, the internal architecture, user interfaces, and COTS/OSS product selection are open to redesign. Testing methodologies and operational processes are also open for optimization.
• Deployment Success Factors: Ashore and fixed OCONUS deployments are most successful due to stable, high-bandwidth infrastructure. Tactical OCONUS and afloat deployments face higher risks due to network latency, update constraints, and external operational factors.
• Software Delivery Model: A clear separation of duties exists: packaging/signing in the software factory, and replication/installation via Application Arsenal at the tactical edge, supporting push/pull models.
• RMF/Cyber Bottlenecks: The biggest bottleneck is the lack of automated, machine-readable evidence generation for RMF/Cyber compliance.
• Future-State Architecture (3-5 Years): The goal is an infrastructure-agnostic architecture enabling software deployment anywhere without platform-specific re-engineering, delivered on a quarterly cadence.
• Modular Architecture: The government is open to a modular, OCI-based, package-driven architecture that reduces sustainment burden and improves portability. Application Arsenal currently uses OCI-compliant images with custom configurations.

These clarifications provide vendors with a deeper understanding of the technical environment, operational challenges, and future direction of the "Application Arsenal" program, which may influence their proposal strategy and technical approach.

Statement of Work (SOW) / Performance Work Statement (PWS)

To procure engineering, software development, technical services, and program management for the continued design, implementation, security, and sustainment of the Application Arsenal (AA) enterprise service. The primary objective is to deliver comprehensive lifecycle support to ensure the system operates securely and effectively, meeting the evolving needs of the warfighter and government personnel.

• Full lifecycle systems engineering and software sustainment for the AA platform.

• Modernizing existing deployment architectures by leveraging and integrating with the Overmatch Software Armory (OSA) DevSecOps pipeline, deploying with Agile Core Services (ACS), and ensuring alignment with the Common Hosting Environment (CHE).

• Designing and implementing scalable, secure integration pathways for Navy programs, ensuring compliance with mandated DevSecOps tooling, security guardrails, and enterprise release practices, including interoperability with Five Eyes (FVEY) partners.

• Engineering and integrating cybersecurity controls into new AA releases aligned with Risk Management Framework (RMF) standards.

• Installation, configuration, and testing of new releases across authorized operational environments (CONUS and OCONUS, ashore and afloat).

• Developing and validating secure methods for software artifact transfer and replication to remote and distributed environments.

• Integrating with existing infrastructure and established Cross-Domain Solutions (CDS) for secure, bi-directional data transfer.

• Supporting the integration of edge servers, autonomous vehicle platforms, and related mission systems.

• Providing rapid technical response to issues using agile software approaches for development, testing, and integration of new C4I capabilities.

• Providing comprehensive support to sustain the functionality, security, and operational availability of all fielded AA releases, including Operations & Maintenance (O&M), System Administration, Cyber & Information Assurance (IA), and Help Desk support.

• Providing engineering and technical support for the sustainment of previously fielded software, infrastructure, and cross-domain capabilities.

• Providing training and logistics support for sustained systems.

• Generating, updating, and maintaining a Technical Data Package (TDP) for all supported systems.

• System Sustainment & Availability: Maintain operational availability during standard business hours, excluding scheduled maintenance.

• Rapid Agile Development & Support: 95% of committed story points completed per sprint.

• CDRL Delivery: 100% on-time delivery; no more than one rejection per CDRL submission.

• Cybersecurity & Information Assurance: Maintain security posture with no incidents from contractor negligence. Remediate vulnerabilities per DoD directives (Critical: 14 days, High: 30 days, Medium: 90 days, Low: 180 days). 100% compliance.

• Training & Logistics Support: 100% on-time delivery and execution of training events and logistics deliverables.

• Not explicitly defined in this document, but implies CONUS and OCONUS locations, ashore and afloat.

• Travel may be required to various Combatant Commands (e.g., USAFRICOM, USCENTCOM, USEUCOM, USINDOPACOM, USNORTHCOM, USSOUTHCOM).

• Security: Work may require access up to SECRET level, with potential for TOP SECRET within laboratories and vessels. Adherence to DD Form 254 is required.

• Applicable Documents: Compliance with NIST SP 800-53 and applicable DoD/DoN regulations, directives, and instructions.

• Property: No Government Furnished Property (GFP) is anticipated.

• Travel: No travel is anticipated, but if required, it will be authorized separately by the COR on a cost-reimbursable basis, originating from San Diego, CA.

Market Survey

This Market Survey (MS) is for the Application Arsenal (AA) Enterprise Engineering and Lifecycle Support procurement (Reference Number: N66001-26-R-3507). It is specifically for Seaport contract holders and is intended to assess Small Business capabilities. Large businesses are not required to respond. The government is planning for a potential set-aside for small businesses or other small business preference groups.

The contractor will be responsible for the full lifecycle of systems engineering and software sustainment for the AA platform. This includes providing all necessary personnel, materials, and services. The primary technical environment is the Overmatch Software Armory (OSA), with potential work in other DevSecOps pipelines like ORION. The contract is intended to be the primary support vehicle for the AA platform.

• Development: Planning, development, testing, and integration for new AA releases and enhancements, including modernizing deployment architectures, integrating with OSA, and ensuring compliance with DevSecOps tooling and security guardrails.

• Cybersecurity Engineering: Engineering and integrating cybersecurity controls, aligning with Risk Management Framework (RMF) standards, and producing documentation for Authority to Operate (ATO).

• Fielding: Installation, configuration, and testing of new releases across authorized environments.

• Sustainment: Operations & Maintenance (O&M), system administration (CSWF-qualified personnel), Cyber & Information Assurance (IA) support, and Help Desk support.

• Sustainment of Fielded Capabilities: Engineering and technical support for previously fielded software, infrastructure, and cross-domain capabilities.

• Contract Type: Anticipated Cost-Plus-Fixed-Fee (CPFF).

• Period of Performance: Six (6) years (one base year and four 1-year options).

• Estimated Level of Effort: Approximately 25-30 Full Time Equivalents (FTEs) per year.

• Estimated Dollar Range: >$30M - $50M.

• NAICS Code: 541330 (Engineering Services) with a size standard of $47.0 million.

• Response Limit: Not to exceed 10 single-sided pages.

• Formatting: 8.5x11 inch paper, single-spaced, 1-inch margins, 10-point Times New Roman font. Graphics are not allowed; tables and charts are permitted and count against page limit.

• Submission: Via email to Corbin Walters (corbin.c.walters.civ@us.navy.mil) with reference number N66001-26-R-3507.

• Required Information: Corporate Description (firm name, size status, ownership, POCs, CAGE/UEI, Seaport Contract Number, affiliate info, facility clearance, accounting system statement) and Corporate Experience (1-3 citations for relevant experience in specified key areas, using Attachment 2 format).

• Target Audience: Small Business firms with capabilities.

• Limitations on Subcontracting: Applicable FAR clauses will be included for set-aside contracts.

• Similarly Situated Entities (SSEs): Specific requirements apply if using SSEs.

• Questions Deadline: 27 April 2026

• Response Closing Date: 04 May 2026, 15:00 PST

• This is for planning purposes only and is not a solicitation.

• No reimbursement for costs associated with providing information.

• The government will post the acquisition strategy decision on SAM.gov after evaluation.