Request for Whitepapers: AEDC Velocity Alliance - A Multi-Billion Dollar OTA Consortium Opportunity

Form / Attachment / Pricing Sheet

This document provides information regarding the Cybersecurity Maturity Model Certification (CMMC) Program, outlining its phased implementation and assessment requirements. It serves as a reference for potential bidders to understand the cybersecurity standards they may need to meet for Department of War (DoW) contracts.

• CMMC Program Overview: Explains the purpose of CMMC in assessing defense contractor cybersecurity compliance for Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).
• CMMC Model Levels: Details three levels of certification (Level 1, Level 2, Level 3) with corresponding security requirements, assessment types, and affirmation requirements.
• Protected Information: Defines FCI and CUI.
• Assessment Requirements: Outlines the specific security requirements for each CMMC level, including the number of requirements and the source (e.g., FAR, NIST SP 800-171).
• Post-Assessment Remediation: Explains the use of Plans of Actions and Milestones (POA&Ms) for Levels 2 and 3.
• Phased Implementation: Describes a four-phase plan for CMMC implementation from November 2025 to November 2028, detailing when different levels of certification will be required.

Bidders should review this document to understand the cybersecurity compliance requirements that may be applicable to current and future solicitations. It details the phased rollout of CMMC, indicating when specific CMMC levels will become mandatory for contract awards. Understanding these requirements is crucial for preparing proposals and ensuring compliance.

Other / Unclassified

This document outlines the objectives and project categories for the Arnold Engineering Development Complex (AEDC) Velocity Alliance Program. The program aims to sustain and advance AEDC's flight simulation test facilities through improvement, modernization, restoration, and maintenance of critical test assets and supporting utilities. Key goals include enhancing operational readiness, integrating innovative engineering solutions, increasing system reliability, and ensuring long-term viability.

The document details various project types and their scope definitions, which are crucial for potential bidders to understand the range of work AEDC is undertaking. The categories cover a broad spectrum of construction, industrial, process systems (low and high pressure, hazardous), electrical (high, medium, low voltage), fire suppression, equipment repair, mechanical and electrical engineering services, ID&C systems, and utilities. This information helps vendors assess their capabilities and determine their interest and suitability for future opportunities within the Velocity Alliance Program.

Other / Unclassified

This document is a Memorandum for AEDC Velocity Alliance Consortium Members, dated March 5, 2026. It provides definitions for terms used throughout the "Agreement," which is identified as an Other Transaction (OT) Agreement executed under the authority of 10 U.S.C. § 4022. The memorandum details various terms such as Acceptance, Acceptance Criteria, Agreement, Agreements Officer (AO), CUI, Cyber Incident, CMMC, Force Majeure, Government-Furnished Property (GFP), Milestone, Statement of Work (SOW), and others.

It also outlines articles related to Demonstration and Acceptance, Assignment of Payments, Agreement Modifications, Collaborative Dispute Resolution, Excusable Delays, Intellectual Property Indemnification, Payment and Invoicing, Risk of Loss, Taxes and Duties, Termination for Convenience, Termination for Default, Title and Ownership, Limited Warranty, Limitation of Liability, Compliance with Law and Agreement Status, Specific Statutory Requirements, Third-Party Terms of Service (TOS) and End User License Agreements (EULAs), Limitation of Obligation and Milestone Funding, Intellectual Property Rights, Stop-Work Order, Delivery, Defense Priorities and Allocation System (DPAS), System for Award Management (SAM), Joint Certification Program (JCP), Cybersecurity Requirements (CUI and CMMC), Country of Origin, Cyber Incident Reporting and Response, Prohibited Sources, Prohibition on ByteDance Covered Applications, Comptroller General Access to Records, Phased Execution and Optional Milestones, Duty-Free Entry, Membership and Good Standing, Project Process, Project Suspension, Operational Security and Public Release of Information, and Order of Precedence.

This document serves as a foundational reference for potential bidders by defining key terms and outlining the contractual framework for an Other Transaction Agreement. It clarifies the rights, responsibilities, and procedures governing the agreement, including aspects like acceptance criteria, dispute resolution, intellectual property, payment terms, cybersecurity requirements (CMMC Level 2), and termination clauses. Understanding these definitions and articles is crucial for any consortium member or potential bidder to comprehend the operational and legal aspects of participating in the AEDC Velocity Alliance and any subsequent projects or opportunities issued under this agreement.

Solicitation / RFP / RFQ

This document is a Request for Whitepapers to solicit vendors for membership in the AEDC Velocity Alliance. The Alliance is a strategic consortium initiative established under 10 U.S.C. § 4022 to accelerate the sustainment, restoration, and modernization of critical test infrastructure for next-generation national defense systems. Projects under this initiative will be competed exclusively among Alliance members. The Air Force anticipates investing multi-billion dollars in test infrastructure at AEDC through Fiscal Year 2032.

Vendors must submit a whitepaper demonstrating their capabilities and expertise. The whitepaper submission process involves several steps:

• Whitepaper Submission: In accordance with instructions, demonstrating agreement to the "Statement of Understanding."
• Government Evaluation: Based on Pass/Fail criteria including mandatory certifications and technical competency.
• Invitation to Site Visit: For successful vendors.
• Mandatory Site Visit: Attendance required at Arnold Air Force Base, TN.
• Execution of Membership Agreement: Upon successful completion of the site visit.

Mandatory certification requirements include:

• Joint Certification Program (JCP): Current certification required.
• Cybersecurity Maturity Model Certification (CMMC): Either CMMC Level 2 certified or an alternative compliance path including a NIST SP 800-171 Assessment and a CMMC Level 2 compliance roadmap with a deadline of November 2026.

Technical competency will be evaluated based on responses to specific project type questions, demonstrating past performance within the last five years.

This is an unfunded solicitation for qualification. The Government is not responsible for any costs incurred by vendors. Financial obligations begin only upon the award of a specific, funded Project-Level Agreement to an Alliance member.

• Whitepaper responses must be submitted electronically as a single, searchable PDF, not exceeding ten pages.

• Evaluation is a four-part Pass/Fail process: Mandatory Certifications, Technical Competency, Intellectual Property Rights Acknowledgement, and Innovation and Partnership Capability.

• Vendors must receive a "Pass" on all four parts to be considered for membership.

• Key deadlines for whitepaper responses are provided for multiple onboarding phases, with an anticipated Alliance live date of July 1, 2026.

• The Innovation and Partnership Capability section requires vendors to identify at least one partner company that is either a Non-Traditional Defense Contractor (NDC) or a small business, demonstrating their significant contribution to the project.

• The Request for Whitepapers notice will remain active until September 30, 2032.

• Governing documents (SOO and Base Articles) are considered "living documents" and subject to change.

• All questions must be submitted in writing via email.

Questions & Answers / Clarifications

This document provides Frequently Asked Questions (FAQs) regarding the Cybersecurity Maturity Model Certification (CMMC) Program, as of Revision 2.2. It aims to clarify requirements, processes, and policies for organizations seeking to comply with CMMC.

• CMMC Implementation Timeline: CMMC assessment requirements will begin to be incorporated into applicable procurements starting November 10, 2025. The initial 12 months will focus on self-assessments.
• NIST SP 800-171 and CMMC: NIST SP 800-171 is the federal standard for safeguarding controlled unclassified information (CUI). CMMC Level 2 assessments will verify compliance with NIST SP 800-171 Revision 2. The Department plans to incorporate Revision 3 in the future.
• Flow Down to Subcontractors: CMMC requirements will flow down to subcontractors based on the type of data (FCI or CUI) they handle.
• Assessment Frequency: Level 1 self-assessments are required annually, while Levels 2 and 3 require assessments every three years.
• Scope of CMMC: CMMC applies to nonfederal unclassified information systems that process, store, or transmit FCI or CUI. It does not apply to classified systems or environments.
• External Service Providers: Cloud Service Providers (CSPs) must meet FedRAMP Moderate baseline requirements if processing, storing, or transmitting CUI. Managed Service Providers (MSPs) and Managed Security Service Providers (MSSPs) may be assessed as part of the Organization Seeking Assessment's (OSA) evaluation, but do not require their own CMMC certification.
• Hard-copy CUI: Organizations handling only hard-copy CUI are generally not required to complete a CMMC Assessment, but must still safeguard the information. If hard-copy CUI is digitized, the information technology system used is subject to CMMC requirements.

This document clarifies key aspects of the CMMC program that bidders and contractors need to understand for future solicitations and contract performance. It details when CMMC will be required, the standards used (NIST SP 800-171), and how requirements apply to different entities, including subcontractors and external service providers. Understanding these FAQs is crucial for preparing accurate proposals and ensuring compliance.