*AMENDED* Mock Cyber Operational Readiness Assessment (CORA)

This Combined Synopsis/Solicitation (N0018926Q0006) outlines a 100% small business set-aside for services to identify, document, and assess security vulnerabilities and risks within the United States Naval Academy's (USNA) unclassified educational environment. The Naval Supply Systems Command (NAVSUP) FLC Norfolk seeks a Firm-Fixed-Price (FFP) contract award based on technical and price factors. Key dates include questions due by December 16, 2025, at 02:30 PM EST, and quotes due by December 19, 2025, at 11:00 AM EST. Contractors must be registered in SAM.gov and familiar with FAR and DFARS clauses. The solicitation details quote content, evaluation criteria (Technical and Price), and specific clauses regarding safeguarding information, telecommunications equipment, and various representations and certifications.

The document addresses questions and answers for Solicitation N0018926Q0006, focusing on a Mock CORA cybersecurity inspection-readiness effort for the U.S. Naval Academy (USNA). Key points include the inapplicability of the ITVAR Exception clause for NAICS code 541519, confirmation that this is a new requirement with no incumbent, and an acceptable period of performance extension to April 30, 2026, provided all deliverables are met. The two-week on-site assessment and all reporting activities for CLIN 0001 must be completed within this timeframe. The solicitation due date will not be extended. Contractors need a current NIST SP 800-171 DoD Assessment score posted in SPRS to be considered for award, but CMMC Level 2 certification is not required for this unclassified educational environment. Contractor personnel will not require privileged IT access, and all work is performed by USNA personnel with assessors observing. An on-site inspection with 8-10 personnel is expected, with daily email summaries and hotwashes. No weekend or after-hours work is permitted. The assessment scope includes approximately 100 network, server, and workstations, focusing on Windows, MacOS, and RedHat/Ubuntu operating systems. USNA will provide inventories and asset lists prior to engagement.

This Combined Synopsis/Solicitation (N0018926Q0006) outlines the United States Naval Academy's (USNA) requirement for services to identify, document, and assess security vulnerabilities and risks within its unclassified educational environment. The solicitation, a 100% small business set-aside, seeks a Firm-Fixed-Price (FFP) contract for "Mock CORA Assessment Services." Quotes are due by December 19, 2025, and questions by December 16, 2025. Evaluation will be based on technical capability (acceptable/unacceptable) and price, with technical proposals needing to meet all requirements and the Performance Work Statement (PWS). The period of performance is from 2 Days After Date of Contract (ADC) to March 30, 2026, at the USNA in Annapolis, MD. Offerors must be registered in SAM.gov and comply with various FAR and DFARS clauses, including those related to safeguarding covered contractor information systems and prohibitions on certain telecommunications equipment.