Sources Sought Notice: United States Naval Academy Military Service Academy Portal Development and Sustainment

Scope of Work

• The Naval Academy seeks non-personal support services to manage, build, and maintain a fully operational online portal for the Service Academy nominations process required by Section 575 of the FY21 NDAA (Draft Performance Work Statement- Common Nominations Portal.docx).
• The portal is called the Common Nominations Portal (CNP). It gives Congressional and non-Congressional nominating sources a single online entry point to record nomination decisions for the U.S. Military Academy, U.S. Naval Academy, and U.S. Air Force Academy (Draft Performance Work Statement- Common Nominations Portal.docx).
• The CNP is described as at an advanced stage of development and almost ready for deployment, dependent on a successful Authorization to Operate (ATO). Year one covers finalizing development, deployment, and stabilization. Later years cover sustainment and maintenance (Draft Performance Work Statement- Common Nominations Portal.docx).
• Task 1 is Portal Development and Deployment. It covers the functions for MSA admissions staff and congressional staff, training, ATO support, STIG and RMF compliance, and reports and dashboards (Draft Performance Work Statement- Common Nominations Portal.docx).
• Task II is Portal Sustainment. It covers system administrator functions, defect remediation, enhancements, data integration support, ad-hoc training, help desk monitoring, cybersecurity monitoring, and a data mapping document (Draft Performance Work Statement- Common Nominations Portal.docx).
• Data visualization and data analytics support are required for the Congressional reporting in Section 575, including an annual statistical report that must be publicly available (Draft Performance Work Statement- Common Nominations Portal.docx).
• The period of performance is a 12-month base period plus four 1-year option periods (Draft Performance Work Statement- Common Nominations Portal.docx).
• Work is remote. Travel may be required at the Government's request and must be pre-approved in writing by the COR (Draft Performance Work Statement- Common Nominations Portal.docx).
• The Government will furnish laptops for the data migration environment, to be returned at the end of the contract. The Contractor furnishes all other supplies, equipment, facilities, and services (Draft Performance Work Statement- Common Nominations Portal.docx).

Key Requirements

• Build and deploy the portal using software the government specifies (Draft Performance Work Statement- Common Nominations Portal.docx): "The Contractor shall leverage software specified by the government to build and deploy the nominations portal."
• Apply STIGs in line with NIST RMF standards (Draft Performance Work Statement- Common Nominations Portal.docx): "The Contractor shall apply all STIGS in adherence to National Institute of Standards and Technology (NIST) standards for Risk Management Framework (RMF)."
• The hosting environment is RedHat Enterprise servers at IL4 within NAVSUP Neptune Cloud Services (Draft Performance Work Statement- Common Nominations Portal.docx): "The environment is RedHat Enterprise servers within an IL4 secure environment."
• Support the COR in obtaining the PA or ATO (Draft Performance Work Statement- Common Nominations Portal.docx): "The Contractor shall assist the COR in obtaining a Preliminary Authorization (PA) or Authority to Operate (ATO) by providing technical specifications required from the authorizing authority."
• Provide initial training around deployment (Draft Performance Work Statement- Common Nominations Portal.docx): "The Contractor shall provide initial training prior to and during the deployment of the application into production."
• Produce reports and dashboards with a government-specified reporting tool (Draft Performance Work Statement- Common Nominations Portal.docx): "The Contractor shall leverage a reporting tool specified by the government to produce reports and dashboards for the MSAs for each application cycle."
• Report and dashboard elements must be publicly viewable (Draft Performance Work Statement- Common Nominations Portal.docx): "The report and dashboard elements shall be accessible on a public Department of Defense (DOD) webpage."
• The annual statistical report must be filterable, downloadable, and sortable (Draft Performance Work Statement- Common Nominations Portal.docx): "The annual statistical report required by law to be available on a publicly accessible website must be filterable, downloadable, and can be sorted."
• Use Agile and Scrum practices (Draft Performance Work Statement- Common Nominations Portal.docx): "The Contractor shall design, build, and deploy the portal using best practices in Agile and Scrum-based software development (e.g., daily standups, sprint planning and sprint review sessions, sprint demonstrations)."
• Perform cybersecurity monitoring of the portal and the cloud environment (Draft Performance Work Statement- Common Nominations Portal.docx): "Cybersecurity monitoring of both the portal and Neptune Cloud Services environment."
• Rejected deliverables must be resolved within 10 business days (Draft Performance Work Statement- Common Nominations Portal.docx): "If the COR rejects the deliverable, the Contractor shall acknowledge, address and resolve any comments or concerns no later than 10 business days after notification of a rejected deliverable."
• The COR reviews and accepts or rejects each deliverable within 15 business days of receipt. This is stated in a sentence that cannot be copied here without altering a character (Draft Performance Work Statement- Common Nominations Portal.docx).
• Monthly Status Reports are due on the 15th of each month (Draft Performance Work Statement- Common Nominations Portal.docx): "If the 15th falls on a weekend, the Monday following the 15th."
• Other listed deliverables are the Technical Design Document, MSA Data Transfers listing, User Guide, Training Plan, Full Deployment to Production, the Common Nominations Portal, the Annual Statistical Report, and Full Knowledge Transfer to USNA (Draft Performance Work Statement- Common Nominations Portal.docx). Several are due NLT July 2027 or end of July 2027, pending PA or ATO. Knowledge transfer is due NLT end of FY31 (Draft Performance Work Statement- Common Nominations Portal.docx).
• Work is performed virtually (Draft Performance Work Statement- Common Nominations Portal.docx): "Day-to-day work shall be conducted virtually via teleconferencing software, e.g. Microsoft Teams, Google Meet, or Zoom."
• All contractor personnel need at least a Tier 3 investigation (Draft Performance Work Statement- Common Nominations Portal.docx): "At minimum, all contractor personnel must possess/maintain a favorable Tier 3 investigation; formerly a NAC with Local Agency Check and Credit Check (NACLC)."
• Interim clearance approval is not authorized under the NAVSUP access language (Draft Performance Work Statement- Common Nominations Portal.docx): "In addition, interim approval of clearances is not authorized."
• Contractor personnel must be U.S. citizens (Draft Performance Work Statement- Common Nominations Portal.docx): "Be citizens of the U.S."
• Access paperwork must reach the security manager 30 days before a person starts (Draft Performance Work Statement- Common Nominations Portal.docx): "The SAAR shall be forwarded to the CSM at least thirty (30) days prior to the individual's start date."
• A contractor security representative must be named within 3 work days of award (Draft Performance Work Statement- Common Nominations Portal.docx): "Within three (3) work days after contract award, the contractor shall provide to the requiring activity's Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the contractor's security representative."

Submission Instructions

• The documents give no instructions for what a sources sought response must contain, such as capability statement format, page limits, past performance, or where to send it (not specified in these documents).
• The response deadline is November 6, 2026 at 11:00 AM EST. This comes from the notice header, not from the attached document text.
• No submission email address, portal, or point of contact is given in the attached text (not specified in these documents).
• Pricing or rate submission is not requested in the attached text (not specified in these documents).

Risks and Red Flags

• ATO dependency: Deployment depends on the PA or ATO being in place, and several deliverables are due NLT July 2027 pending that approval. The ATO is controlled by the Government.
• Timeline inconsistency: One passage says full production deployment is projected in option year two. Other passages say the Base Year deployment is estimated between February and July 2027, with deliverables due NLT July 2027.
• Conflicting interim access language: One section says the CSM may authorize interim access, while the later NAVSUP section says interim approval of clearances is not authorized. Plan for the stricter rule.
• Staffing lead time: All personnel need a Tier 3 investigation and CAC readiness before reporting. The SAAR is due 30 days before a start date. No reimbursement is paid for start-up period efforts, and invoicing begins only when the performance period begins.
• Mixed security language: The text includes boilerplate that appears to be from other contexts, such as references to ERP, foreign nationals at foreign locations, lawn maintenance, and JPAS and EQIP. It also names both a USNA COR and a NAVSUP COR, which is unclear.
• Remote work versus in-processing: Work is remote, but the text requires in-processing with the command's security manager and ISSM/IAM.
• Technology mix: The deliverables name Salesforce, MuleSoft, and Tableau, while the tasks say "software specified by the government." Confirm the required platforms.
• Scope variability: Legislative changes and enhancement requests may require added personnel and contract modifications. The Government may decline requests well outside the application's capabilities.
• High user turnover: Congressional staff turnover is high, which implies recurring and possibly one-on-one training demand.
• OMB Directive 15 changes: The annual report must account for academies deploying the new standards at different times over five years.
• Missing commercial details: The documents give no contract type, estimated value, labor categories, hours, staffing levels, or evaluation approach.
• Long transition horizon: Knowledge transfer is due NLT end of FY31 and must be planned from the start.
• Document numbering gap: The sections jump from VI to VIII, so a Section VII may be missing from the text provided.