DON26BZ05-DV082 — Cross-domain Interface for Trusted Access & Data Exchange Logic (CITADEL)
Below is a brief summary. Please check the full solicitation before applying (link in resources section).
Quick Answer
DON26BZ05-DV082 is a Navy Direct to Phase II (DP2) SBIR topic sponsored by NAVAIR. It funds a bi-directional software Cross Domain System (CDS) guard that runs on small form factor, PCIe-based commercial computer modules aboard Navy aircraft and ships. The government references CITADEL as a demonstrated approach to this problem. Maximum Phase II award across Base and Option is $1,400,000. Proposals are due September 23, 2026.
Executive Summary
Navy aircraft and ships need to move data securely between networks with different classification or trust levels, and doing that today typically requires large, expensive, purpose-built hardware guards. NAVAIR wants a bi-directional software CDS guard that instead runs on small, modular, removable, commercially available computer systems with an open PCIe interface, so the capability can be fielded more cheaply and updated faster.
The hardware baseline is specific: at minimum a 10-core processor, 64 GB of DDR5 RAM, 2 TB of SSD storage, at least four 1 GigE ports, four USB ports, and one HDMI or DisplayPort interface. On top of that hardware, the software architecture needs to support rapid rule set updates so the guard can be re-certified and re-approved by the NSA more efficiently than legacy guard systems allow, and it needs an affordable licensing model that keeps acquisition and sustainment costs down for the Navy over the life of the program.
Functionally, the guard must parse up to 100 Mbps of mixed data types, including video streams, tracks, messaging, and voice, and it must log that data. Business rules will be provided by the government as classified Government Furnished Equipment after award, and the architecture needs to let the contractor maintain and update those rules in a data library without requiring a full software rebuild every time a rule changes.
The Phase I feasibility bar here is unusually specific: NAVAIR references CITADEL directly, describing a system that has already demonstrated a cross domain guard on commercial single board computers while emphasizing affordability, modularity, and rapid prototyping, all while maintaining high assurance through hardware and software controls. Companies proposing on this topic should be prepared to show a comparable level of demonstrated capability, since the government is essentially describing the shape of qualifying prior work.
Phase II calls for a working demonstration: a bi-directional guard running across four COTS, removable, plug-and-play computer modules, parsing IP-based HF track data, voice, and messaging, with one module hosting the guard itself. The software architecture also needs to be structured in a way that supports NSA approval through a partitioned layout, minimizing how often the whole system needs re-approval when rules change.
This work is expected to become classified, and the contractor must be able to obtain and maintain a secret facility clearance and personnel clearances. Dual-use potential is strong for critical infrastructure operators such as energy, transportation, and port authorities, along with financial services, healthcare networks, and cloud providers who need to move data across trust boundaries under regulatory or cybersecurity constraints.
Funding
Phase II Base: up to $1,000,000, period of performance up to 30 months
Phase II Option: up to $400,000, period of performance up to 12 months
Maximum total (Base plus Option): $1,400,000
No separate Phase I award is issued under DP2
Award types considered: Cost Plus Fixed Fee, Firm Fixed Price, Basic Ordering Agreement, or Prototype Other Transaction
Discretionary TABA available: up to $25,000 per award, included in the Phase II award amount
Timeline
Step one: submit a Phase I Feasibility Proposal through DSIP
Step two: if selected, the SYSCOM contacts the company directly with instructions to submit a Full DP2 Proposal
Proposal deadline: September 23, 2026 (verify against the official BAA close date for this release)
Notifications sent approximately one week after BAA close, based on the Cover Sheet email address
Key Requirements
Must demonstrate completed Phase I-type R&D independently, not solely from prior federal SBIR/STTR funding
Must show prior work comparable to the CITADEL description: a cross domain guard on commercial single board computers emphasizing affordability, modularity, and rapid prototyping
Technical Volume limited to 30 pages total: 20 pages for Phase I feasibility, 10 pages for the Phase II snapshot
Minimum 50 percent of Phase II work performed by the proposing small business, in both Base and Option
CMMC Level 2 (Self) projected requirement
Must be able to obtain a secret facility clearance and personnel clearances for classified Phase II work
Point of Contact
Kristi DePriest, Naval Air Systems Command (NAVAIR)
navair-sbir@us.navy.mil
Frequently Asked Questions
What is CITADEL?
CITADEL is referenced in the topic as the type of cross domain guard capability NAVAIR expects proposers to have already demonstrated: a bi-directional software guard on commercial single board computers, built for affordability, modularity, and rapid prototyping.
What hardware must the guard run on?
Small form factor, modular, removable commercial computer systems with a PCIe open systems interface, with a minimum baseline of a 10-core processor, 64 GB DDR5 RAM, 2 TB SSD storage, four 1 GigE ports, four USB ports, and one HDMI or DisplayPort interface.
How much data must the guard be able to handle?
Up to 100 Mbps of parsed data, including video streams, tracks, messaging, and voice, with data logging support.
Does this require a security clearance?
Yes. Work is expected to become classified in Phase II, and the contractor must be able to obtain and maintain a secret facility clearance and personnel security clearances.
What does Phase II deliver?
A demonstrated bi-directional CDS guard running across four COTS, removable, plug-and-play computer modules, parsing IP-based HF track data, voice, and messaging, with a software architecture designed to minimize repeated NSA re-approval as rules change.
How much can a Phase II award be worth?
Up to $1,000,000 for the Base and up to $400,000 for the Option, for a maximum of $1,400,000.
What is the proposal deadline?
September 23, 2026
