Hanscom Published the Answer Key

On April 13, 2020, the Air Force seated seventeen companies on a vehicle called Force Protection Site Security System Solutions. Four of them got the regional work.

Xator took Eastern, CACI took USAFE, M. C. Dean took Western, Johnson Controls took Central. Each held both halves of its own territory, the design-and-install and the sustainment, while the other thirteen holders watched.

Across the four: $177,383,609.18 obligated, $406,679,979.28 if every option runs.

FPS4's ordering period closed on April 12, 2025, 541 days ago, and the follow-on still has no solicitation number you can search. What it has is a draft package, and the office behind it is doing something worth stopping on.

What They Actually Posted

At 8:24 Eastern this morning, AFLCMC's Force Protection Systems Division reposted the draft RFP for GUARD, Global Unified Airbase Readiness and Defense, a multiple-award IDIQ for integrated base defense security systems out of Hanscom. Ten files hang off the notice.

Section L. Section M. The draft statement of work, the draft performance work statement, the draft SF33, the cost and price template, a comment resolution matrix, and the relevant experience self-scoring matrix.

Everything an offeror would get on day one of a live solicitation, dated 21 Sept 2026 and posted while the strategy is still movable.

Comments are due by noon Eastern on October 14, nine days out, on the matrix they provided, each item labelled C for critical, S for substantive, or A for administrative. Industry day is October 20 at Hanscom and on Teams, with one-on-ones starting the 21st at 45 minutes a company.

Every answer, from the matrix and from the sessions, gets published in one consolidated document before the formal RFP.

And the industry day notice states in writing why its own schedule changed:

"Responses to the initially posted Industry Day announcement indicated that respondents would prefer Day One to be offered in-person and further requested combination of Phases One and Two. As such, the Government is restructuring the planned Industry Day approach."

They asked, got an answer they had not planned for, and moved the event.

Where the Points Are

Attachment J-5 is a six-worksheet spreadsheet carrying 1,651 points, and you fill it in yourself.

Element 2 is sustainment, the biggest block at 500 points (chart below). The unit of account is alarm points: under 1,500 scores 10, 1,500 to 2,999 scores 25, over 3,000 scores 50, with 20 more if any of it covered a SCIF or a SAPF.

Element 5 pays for installing things, 378 across ten items.

Annunciator installation 40, buried line sensor 36, FIPS-201 access control 34, overlapping fields of view at a nuclear security boundary 32, down to exterior video analytics at 20.

Element 1 is ATO artifacts, also 378, scored in two columns by whether the work supported a new authorization or validation against an existing baseline: 20 against 16 for a full STIG and SRG evaluation, 10 against 6 for an SBOM. Element 4 is network engineering, 235 over nine activities, from wireless secure networks at 50 down to 802.1X with MAB, EAP-TLS and MACsec at 15.

So the cyber artifacts and the network work together carry 613 points, against 378 for putting hardware in the ground.

Section M then tells you what a number buys. Ten IDIQ awards to the ten highest technically rated offerors with a fair and reasonable price, two of them reserved for small businesses, who can advance on a lower score than a large business.

The top fifteen Phase I scores go to Phase II. Tie at tenth and everyone tied wins; tie at fifteenth and everyone tied advances.

Total your own sheet this afternoon and you know roughly whether you are inside fifteen.

What It Still Holds Back

Phase II is two sample problems, a conceptual design for an intrusion detection system at a PL 2 ramp and one on network engineering, an hour of presentation each and 40 pages across both. Neither is in the draft.

Price is the other half. Attachment J-4 runs fifteen years of time-and-materials ceiling rates against an estimated start of 1 April 2027, and you price Year 1 only.

Years 2 through 15 escalate on a factor locked in the spreadsheet that offerors are told not to touch: the five-year Employment Cost Index average, 4.08% at release.

No vehicle ceiling appears anywhere. The only dollar figure in the set is the $1,000 firm-fixed-price post-award conference that will be every awardee's first order.

Section L does name the government's own support contractors, Odyssey Systems, Astrion and Torch Technologies, so conflicts get cleared before anyone writes instead of after a protest.

The Calendar It Implies

The structural change sits in the introduction. Under IBDSS Next, one contractor owned design-install and sustainment inside a region.

Under GUARD, sustainment stays regional and design-install gets competed among all the holders, in smaller and more frequent orders issued on imminent need, with government-only pre-award site surveys to tighten the requirement first.

Which makes the four incumbent end dates the ones to carry. Johnson Controls' Central order ends February 9, 2027, and GUARD's own estimated start is April 1, so there are 51 days of daylight in between (chart below).

Western runs to February 2028, USAFE to May 2028, Eastern to June 2028.

One line for your compliance matrix. Section M cites RFO 15.103-3, RFO 19.112(a)(2)(i) and RFO 16.507-6(c), and this morning acquisition.gov/rfo and /far-overhaul both 404 while /far/part-15 serves and runs 15.102 straight into 15.200.

Final Thoughts

Most draft RFPs are a courtesy. A scope paragraph, a NAICS code, a promise the real thing is coming, and you learn what the evaluation actually rewards on the day you have three weeks to answer it.

This one hands over the scoring sheet, the point values, the cut lines and the escalation factor nine days before comments close. Whatever comes back on October 14 will be about the requirement rather than about what the requirement meant.

Thanks for reading.