REQUEST FOR INFORMATION - Next Generation Command and Control (NGC2) Software Application Storefront, Pipeline and Tailorable Warfighting Applications

The U.S. Army, through the Project Manager for Command and Control Applications (PM C2 Apps), is conducting market research via a Request for Information (RFI) to evaluate a transformative acquisition strategy centered on a lead integrator model for managing its entire portfolio of command and control software applications. The goal is to establish a unified, agile development pipeline and application storefront that enables rapid delivery and iteration of mission-critical software at the “speed of relevance,” aligning with the Next Generation Command and Control (NGC2) “clean-slate” philosophy. This approach seeks to consolidate GOTS, COTS, and tactical solutions under a single lead entity responsible for end-to-end lifecycle management, including continuous integration and deployment, automated vulnerability scanning, SBOM generation, and secure distribution to users across hybrid-cloud, on-premise, and disconnected environments. The Government is particularly interested in entities with direct ownership or control over software development capabilities, capable of driving innovation, influencing product roadmaps, and providing direct technical support, rather than intermediaries or resellers. Proposals must demonstrate experience deploying capabilities at TS/SCI and JWICS levels, compliance with DoD Enterprise DevSecOps Reference Design standards, and readiness to operate within IL5 and IL6 security environments with clear paths to cross-domain data transfer and continuous authorization. All responses must be submitted as a single Microsoft Word document, not exceeding 25 pages, using the provided Response Form template, and must include a Rough Order of Magnitude cost estimate and a notional schedule covering the full program lifecycle. The submission deadline is May 27, 2026, at 1200 Eastern Time, and must be emailed to [email hidden] with a specific subject line. Respondents must self-certify their small business status under NAICS 541511 and identify any organizational conflicts of interest, particularly if they intend to both lead the ecosystem and offer their own applications. Security compliance is mandatory and must align with DoD DevSecOps practices, MOSA, OpenAPI standards, and Army-specific cybersecurity controls, with the Government retaining final authority for accreditation and risk acceptance. The lead entity will be expected to govern the storefront, enforce technical standards, manage third-party integrations, and handle liability for code it does not produce—a model still under evaluation. Pricing structures, contract types, and transactional frameworks—including FFP, SaaS subscriptions, OTAs, or hybrid models—are not yet defined, and this RFI is purely