Action Kit: US Air Force CCA Production Contracts & Software Pool

Overview

The U.S. Air Force has awarded the first production contracts for Collaborative Combat Aircraft (CCA) to General Atomics (FQ-42A) and Anduril Industries (FQ-44A), four months ahead of the original schedule. Simultaneously, the Air Force established a competitive six-year software pool with six vendors—Anduril, General Atomics, Lockheed Martin, Northrop Grumman, RTX Collins Aerospace, and Shield AI—to develop autonomous mission software, with three companies beginning immediate work. This represents a major new contract vehicle for autonomous aircraft production, with plans to procure over 150 units by decade's end and approximately 1,000 units long-term. The CCA ecosystem creates significant opportunities for prime contractors, software developers, and subcontractors across the Defense, Aerospace, Autonomous Systems, and Unmanned Aerial Systems market segments. Contractors must act now to position for subcontracting opportunities, software development work, and future CCA production competitions. The accelerated timeline signals the Air Force's urgency in fielding autonomous capabilities, compressing traditional capture cycles. Companies with capabilities in military aircraft manufacturing, defense software development, artificial intelligence, and mission systems should immediately assess their alignment with the CCA Production Contracts and CCA Software Pool vehicles.

Immediate Actions (This Week)

• [ ] Identify teaming opportunities with the six software pool vendors (Anduril, General Atomics, Lockheed Martin, Northrop Grumman, RTX Collins Aerospace, Shield AI) and the two production contract holders (General Atomics, Anduril Industries) by reviewing your existing relationships and past performance in autonomous systems, AI/ML, or unmanned aerial systems
• [ ] Assess your company's NAICS code alignment with the CCA ecosystem (336411 Aircraft Manufacturing, 336413 Other Aircraft Parts and Auxiliary Equipment Manufacturing, 541512 Computer Systems Design Services, 541330 Engineering Services, 541715 Research and Development in the Physical, Engineering, and Life Sciences, 336414 Guided Missile and Space Vehicle Manufacturing)
• [ ] Review your current CMMC (Cybersecurity Maturity Model Certification) and NIST 800-171 (NIST Special Publication 800-171) compliance posture to ensure readiness for subcontracting opportunities under these DOD contracts, as CCA work will require handling Controlled Unclassified Information (CUI (Controlled Unclassified Information))
• [ ] Monitor SAM.gov (System for Award Management) and USAF contracting announcements for follow-on solicitations, subcontracting plans from the prime contractors, and additional software pool task orders
• [ ] Conduct an internal capabilities assessment to determine whether your offerings align with autonomous mission software, AI-driven flight control systems, sensor integration, or aircraft production/manufacturing support
• [ ] Verify ITAR (International Traffic in Arms Regulations) compliance status if your company handles technical data related to defense articles, as CCA technology will be export-controlled

Short-Term Actions (30 Days)

• [ ] Initiate outreach to the prime contractors' subcontracting offices to register your company as a potential supplier and understand their small business subcontracting plans, particularly if you hold 8(a), HUBZone, SDVOSB, or WOSB certifications
• [ ] Develop or update capability statements tailored to CCA-specific requirements: autonomous flight software, mission planning algorithms, AI/ML model development, sensor fusion, communications systems, ground control stations, or manufacturing support for unmanned platforms
• [ ] Establish a capture team to track CCA-related opportunities across the six-year software pool timeline and future production lot competitions, assigning roles for business development, technical proposal development, and compliance review
• [ ] Engage with industry partners in the Autonomous Systems, Defense Software Development, and Military Aircraft Manufacturing sectors to explore joint ventures, teaming agreements, or mentor-protégé arrangements that strengthen your position in the CCA supply chain
• [ ] Complete CMMC Level 2 gap analysis (if not already certified) and remediate any deficiencies in your System Security Plan (SSP), as subcontracts under CCA production will likely require CMMC certification before contract award

Long-Term Actions (90+ Days)

• [ ] Build past performance narratives that demonstrate relevant experience in autonomous systems, unmanned platforms, AI/ML software development, or defense aerospace manufacturing, ensuring these are documented in your Past Performance Information Retrieval System (PPIRS) and readily available for teaming partners
• [ ] Invest in R&D capabilities aligned with the long-term CCA roadmap (approximately 1,000 units planned), focusing on scalable manufacturing processes, software-defined architectures, open mission systems standards, or human-machine teaming technologies
• [ ] Pursue strategic certifications and registrations beyond CMMC, including AS9100 (aerospace quality management), ISO 27001 (information security), or relevant USAF supplier approvals, to differentiate your company in the CCA supply chain
• [ ] Monitor the CCA Software Pool task order awards over the six-year period to identify patterns in the types of work being competed, the evaluation criteria the Air Force prioritizes, and opportunities to transition from subcontractor to prime on future software development efforts
• [ ] Develop a long-term workforce strategy to recruit and retain talent in AI/ML engineering, autonomous systems, flight control software, and cybersecurity, as the CCA program's scale (1,000+ units) will create sustained demand for specialized skills through the next decade

Compliance Checklist

The following compliance regimes are explicitly associated with CCA Production Contracts and the CCA Software Pool based on the DOD and USAF contracting environment:

• [ ] CMMC (Cybersecurity Maturity Model Certification) — Verify your organization's CMMC level and certification status; subcontracts under CCA production will require at least CMMC Level 2 for handling CUI
• [ ] NIST 800-171 — Ensure your System Security Plan (SSP) and Plan of Action & Milestones (POA&M) address all 110 security controls for protecting CUI in non-federal systems
• [ ] ITAR (International Traffic in Arms Regulations) — Confirm your company is registered with the Directorate of Defense Trade Controls (DDTC) and has processes to prevent unauthorized export of CCA technical data
• [ ] DFARS (Defense Federal Acquisition Regulation Supplement) (Defense Federal Acquisition Regulation Supplement) — Review DFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting) and DFARS 252.204-7019 (Notice of NIST SP 800-171 (NIST Special Publication 800-171) DoD (Department of Defense) Assessment Requirements) to ensure contract flow-down compliance
• [ ] DFARS 252.204-7020 — Prepare for NIST SP 800-171 DoD Assessment requirements, including the requirement to have a current assessment (either Basic, Medium, or High) in the Supplier Performance Risk System (SPRS)
• [ ] CUI Handling Procedures — Establish documented procedures for marking, safeguarding, disseminating, and destroying Controlled Unclassified Information in accordance with NIST SP 800-171 and 32 CFR Part 2002

For detailed implementation guidance, refer to the CMMC Compliance Guide (/insights/cmmc-compliance-guide) and CUI-Safe CRM Guide (/insights/cui-safe-crm-guide). Additional resources on federal contracting fundamentals are available in the Winning Federal Contracts Guide (/insights/winning-federal-contracts).

Resources

• DOD CMMC Program: Official CMMC requirements, assessment guides, and certification body information
• USAF Contracting Announcements: Monitor Air Force Life Cycle Management Center (AFLCMC) and Air Force Materiel Command (AFMC) for CCA-related solicitations
• SAM.gov: Search for opportunities using NAICS codes 336411, 336413, 541512, 541330, 541715, 336414 and keywords "Collaborative Combat Aircraft," "CCA," "autonomous aircraft," or "unmanned combat systems"
• NIST SP 800-171 Rev 2: Full text of security requirements for protecting CUI in nonfederal systems
• DFARS Subpart 204.73: Safeguarding Covered Defense Information and Cyber Incident Reporting regulations
• ITAR Regulations (22 CFR 120-130): Export control requirements for defense articles and technical data

How Cabrillo Club Automates This

Cabrillo Signals War Room has already detected this CCA contract award event and delivered this Action Kit within minutes of the announcement. The War Room continuously monitors DOD contract awards, USAF policy updates, and new contract vehicle establishments across federal sources, ensuring you never miss critical developments like the accelerated CCA production timeline or the six-year software pool competition. For an event of this magnitude—representing 1,000+ units long-term and a new competitive ecosystem—the War Room's real-time detection gives you a decisive first-mover advantage in teaming and capture planning.

Cabrillo Signals Match Engine automatically rescored your opportunity pipeline the moment the CCA Production Contracts and CCA Software Pool were announced. If you have opportunities tagged with NAICS codes 336411, 336413, 541512, 541330, 541715, or 336414, or keywords related to autonomous systems, unmanned aerial systems, or defense software development, those opportunities received updated match scores reflecting the new competitive landscape. The Match Engine also flagged any existing USAF opportunities that may now be influenced by CCA priorities, helping you reprioritize your capture resources toward the highest-probability wins.

Cabrillo Signals Intelligence Hub is now tracking the CCA Production Contracts and CCA Software Pool as distinct contract vehicles, linking them to the DOD and USAF agencies and the relevant NAICS codes. Use the saved search feature to configure alerts for follow-on solicitations matching this event's profile—for example, "USAF + autonomous aircraft + NAICS 541512" or "CCA + software development + subcontracting plan." The Intelligence Hub will notify you immediately when the six software pool vendors post subcontracting opportunities or when the Air Force releases additional production lot competitions.

Proposal Studio (Proposal OS) helps you respond to CCA-related opportunities by generating compliance matrices for CMMC, NIST 800-171, ITAR, and DFARS requirements automatically. The AI-powered proposal engine maintains your win theme library—such as past performance in autonomous systems, AI/ML development, or aerospace manufacturing—and produces first-draft technical approaches using your historical project data. When a CCA software pool task order or subcontract solicitation appears, Proposal OS can instantly pull relevant past performance narratives, compliance certifications, and technical capabilities into a tailored response. The bid/no-bid decision engine factors in events like the CCA award automatically, scoring opportunities higher if they align with the newly established contract vehicles and your NAICS code profile.

Proposal Studio Workflow Tracker manages the 9-gate capture process from opportunity identification through post-submission for CCA-related pursuits. When you designate a CCA opportunity in the tracker, it automatically routes compliance reviews to your contracts and legal teams (ensuring CMMC, ITAR, and DFARS flow-downs are addressed), tracks supplier certifications from your subcontractors, and generates audit-ready documentation packages for DCAA or DCMA reviews. For a multi-year program like the CCA Software Pool, the Workflow Tracker maintains a living capture plan that evolves as task orders are released, ensuring your team stays synchronized across business development, technical proposal, and compliance functions.

Explore these features in your Cabrillo Club dashboard to turn the CCA opportunity into a structured, automated capture campaign. The platform has already done the heavy lifting—detection, scoring, and compliance mapping—so your team can focus on building winning relationships and proposals.

---