Part of the DoW SBIR/STTR FY27 Release 2 topic list. Browse all 83 topics by industry or service.
Topic DON27BZ02-NV010 from the DoW SBIR 2027 BAA, Release 2. Pre-release now; proposals due January 6, 2027, 12:00 PM ET.
Quick answer
DON27BZ02-NV010 is a Department of the Navy SBIR topic seeking an automated tool that cyber hardens the Linux operating system on Navy platforms, especially autonomous and unmanned systems. It follows a standard Phase I then Phase II path. Proposals are due January 6, 2027, 12:00 PM ET.
Solicitation at a glance
- Topic number: DON27BZ02-NV010
- Official title: Automated Hardening for Cyber Secure Operating Systems
- Agency: Department of the Navy
- Program: SBIR (DoW SBIR 2027 BAA, Release 2)
- Award type: Phase I (see topic text for Phase II)
- Award amount: Phase I base up to $200,000 plus an option up to $115,000. Source: Navy Release 2 instructions in DSIP.
- CMMC level: Level 2 (Self)
- ITAR: No
- Technology areas: None
- Pre-release (direct TPOC contact allowed): November 4 to December 2, 2026, 8:00 AM ET
- Opens in DSIP: December 2, 2026, 8:00 AM ET
- Proposals due: January 6, 2027, 12:00 PM ET
- Official source: DSIP Topics app (search DON27BZ02-NV010)
BW&CO's take
What the Department of the Navy wants
Hardening the Linux OS on each Navy platform is manual, slow, and spread across separate tools, so developers can miss security features. The Navy wants one automated tool that uses runtime information and ingests specifications, configurations, test plans, and other tool outputs to identify the minimal OS functionality a platform needs, removes unnecessary components, and configures the remainder for better security without breaking the system. The scope is strictly the OS. Phase I delivers a software architecture and a demonstration on a performer-chosen COTS or open-source Linux platform, preferably an autonomous vehicle. Phase II builds a working prototype tested with Navy platform owners.
Who is a good fit
- Software debloating, attack-surface reduction, or Linux configuration hardening tools with measurable results
- Runtime and static analysis of Linux systems to determine which kernel and OS components a workload actually uses
- Access to a COTS or open-source Linux-based autonomous vehicle or robot to use as a Phase I test platform
- Experience quantifying security improvement through code analysis, penetration testing, and code-reduction metrics
Watch-outs
- The proposal itself must include metrics demonstrating the improvements the automated tool will deliver. A proposal without concrete metrics is weaker.
- You must propose your own platform for design and experimentation, preferably an autonomous vehicle. Lacking a credible test platform weakens the Phase I demonstration plan.
- Scope is strictly the Linux OS. Proposals centered on application-level hardening fall outside the stated focus.
- The topic requires CMMC Level 2 (Self). It is not marked as ITAR-restricted in the topic metadata.
Think your company fits DON27BZ02-NV010? Talk with BW&CO before the January 6 deadline.
Plan Your DON27BZ02-NV010 Submission
Official topic text (verbatim from DSIP)
The text in this section is copied word for word from the official DSIP topic as published on November 4, 2026. DSIP is the official source and topics can be amended. Always confirm the current version at dodsbirsttr.mil before you submit. Our commentary above is BW&CO's interpretation, not Government guidance.
Title
Automated Hardening for Cyber Secure Operating Systems
Objective
Develop an automated tool to cyber harden various platform instantiations built on a Linux operating system.
Description
Navy platforms have computing devices that drive their operational capabilities, especially autonomous or unmanned systems. Many platforms such as autonomous vehicles have some version and distribution of Linux as their operating system (OS) as well as an application running on it. Providing cybersecurity to these platforms is not only challenging due to their complexities but also very time consuming from a manpower perspective. This workload includes analyzing all levels of software (to include the OS) and configuring them to make them more secure as well as other cyber hardening operations such as software debloating to remove unnecessary functionality. The Navy has many platforms so each would require its own analysis and hardening. There are various means for improving the cybersecurity posture of the platform, each either manual or with its own tool, which creates undue burden on the developer of the platform for hardening without missing certain security features.
The focus of this SBIR effort is strictly on the OS, in this case Linux. The tool should determine the Linux OS functionality actually required by a specific platform instantiation, remove unnecessary OS components and functionality, and configure the remaining Linux OS to improve cybersecurity posture while preserving required system functionality. The goal is to create an automated tool that analyzes the various specifications, configurations, applications, etc. to harden the cybersecurity posture of the underlying Linux OS. The performer should propose their own platform, preferably either a commercial off-the-shelf (COTS) or open source platform that has a Linux OS and use this for design and experimentation on how to automate the cyber hardening of just the OS. It is preferred that the device be some type of autonomous vehicle. The performer will produce an overall software architecture for the automated OS hardening tool as well as a demonstration of the conceptual capability in Phase I while Phase II will involve development of a prototype in cooperation/guidance with Navy personnel. Metrics to demonstrate the improvements from the automated tool should be provided in the proposal.
Phase I
Determine a conceptual software architecture for an automated cyber hardening tool for the Linux OS. Ensure that this tool will (1) leverage available runtime information for an existing system to identify the minimal set of OS functionality required for system functionality and (2) then recommend and/or configure the OS, removing unnecessary OS components and functionality and add/or configure recommended security features/functionality. At the conclusion of Phase I, present the proposed software architecture (i.e., the tool’s design and specification of functionality) and a demonstration on a representative platform (e.g., COTS or open-source autonomous platform) that shows improvement in cybersecurity posture (e.g., code analysis, pen testing, etc.). Tools will be compared on cybersecurity OS hardening completeness and approach (i.e., architecture) for ingesting various sources to automate the tool’s execution.
Phase II
Develop a functional prototype of the automated tool. Interact with Navy personnel who own a platform and who will provide guidance and experimentation against the prototype OS cyber hardening tool. In conjunction with the Navy, devise, develop, and implement means for verifying the automated OS cyber hardening. Demonstrate that the tool can automatically ingest data sources (e.g., specifications, test plans, other hardening tools capabilities, etc.), and harden and minimalize the Linux OS footprint on the Navy platform. (Note: Navy personnel will examine metrics such as code reduction in the Linux OS, configurations, debloating, code analysis, and pen testing results to measure the effectiveness of the automated OS hardening.) Prepare a Phase III commercialization/transition plan.
Phase III Dual Use Applications
Support the transition to Navy use.
Many commercial platforms leverage the Linux OS (e.g., IoT and Smart Home technology). The manufacturers of those devices often implement them on Linux and also need cyber hardening.
References
“Engineering Trustworthy Secure Systems, NIST SP 800-160 Vol. 1 Rev. 1.” https://csrc.nist.gov/pubs/sp/800/160/v1/r1/final
Brown, Michael D. and Meily, Adam. “Trail of Bits”
Fairservice, Brian; Sood, Akshay and Dorn, Jonathan. “GrammaTech”
Kilmer, Eric and Eytchison, Ronald, “Trail of Bits.” “A Broad Comparative Evaluation of Software Debloating Tools”. 33rd USENIX Security Symposium. https://www.usenix.org/conference/usenixsecurity24/presentation/brown
Keywords
Cybersecurity; Operating System; OS; cyber hardening; Automation; Zero-Trust
Frequently asked questions
What is DON27BZ02-NV010?
It is a Department of the Navy SBIR topic to develop an automated tool that determines the Linux OS functionality a specific platform needs, removes unnecessary OS components and functionality, and configures the rest to improve cybersecurity while preserving required system functions.
When is DON27BZ02-NV010 due?
Proposals are due January 6, 2027, 12:00 PM ET. DSIP pre-release began November 4, 2026, and direct contact with the topic authors is allowed only until the topic opens on December 2, 2026, 8:00 AM ET. After that, questions go through DSIP Topic Q&A.
Is this a Phase I or Direct-to-Phase II topic?
It is a standard Phase I topic. Phase I delivers a conceptual software architecture and a demonstration on a representative COTS or open-source platform. Phase II develops a functional prototype with guidance from Navy personnel who own a platform.
How will the Navy judge the tool's effectiveness?
In Phase I, tools will be compared on OS hardening completeness and on the architecture for ingesting various sources to automate execution. In Phase II, Navy personnel will examine metrics such as Linux OS code reduction, configurations, debloating, code analysis, and penetration testing results.