612572311_Sources_Sought_Cloud Support Services.docx

SOURCES SOUGHT NOTICE

612572311

The Defense Information Systems Agency (DISA) is seeking sources for Enterprise End-to-End Engineering and Platforms Analysis Support (E4PAS).

CONTRACTING OFFICE ADDRESS:

Defense Information Technology Contracting Organization DITCO-NCR/ Procurement Services Directorate (PSD) – PS61/ PO BOX 549 FORT MEADE, MD 20755-0549 USA

INTRODUCTION:

This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of small businesses and large businesses (including the following subsets: Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman-Owned Small Businesses) to provide the required products and/or services.

The Engineering Analysis Platforms Branch (OE22) seeks qualified technical experts to provide support for our on-premises legacy and various GovCloud environments. OE22 provides the infrastructure computing services used to support most of the other Enterprise Engineering Directorate (OE) mission areas with a mix of on-premises and cloud environments supporting both Linux and Microsoft Windows operating systems. This requires expertise in network engineering, system engineering, system administration, security, and compliance. The contractors shall provide support for planning, designing, implementing, administering, troubleshooting, and managing NIPRNET, SIPRNET, Cross Domain Solutions (CDS), diverse network infrastructures, and tool/dashboard development for performance monitoring. Support will also include fulfilling system requests for on-premises enclaves and various Impact Level 5 (IL5) and (IL6) GovCloud environments. Given the evolving nature of our work, contractors must be adaptable and able to effectively engage with emerging technologies.

The contractor will also support the Accreditation To Operate (ATO) approval process, ensuring on-premises and GovCloud environments adhere to all applicable DoD Information Assurance (IA) standards and cybersecurity regulations. OE22 has a recurring need for support in understanding, implementing, and maintaining updates to Security Controls specified by the Risk Management Framework (RMF). This contract will support OE22's efforts to ensure all systems align strategically with the highest standards of Department of Defense (DoD) cybersecurity practices.

This effort under E4PAS requires Capability Maturity Model Integration (CMMI) Level 4 to ensure robust processes for providing and managing unique user environments across on-premises legacy and various GovCloud platforms for diverse Modeling and Simulation analysis requirements. This level of maturity is essential for building and benchmarking key capabilities, such as supporting end-users on both on-premises and GovCloud platforms, enabling mission-critical network traffic analyses, capacity planning, creating ad-hoc reports/dashboards, rapid project prototyping, in-house application development, and system integration.

The anticipated Period of Performance is 16 January 2026 – 15 January 2031.

The anticipated Place of Performance is Government facilities at Fort George G. Meade in MD.

DISCLAIMER:

THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND: Not Applicable. This is a new requirement.

REQUIRED CAPABILITIES:

The following items identify key area of interest for the requirement address what the Government is looking for contractor capabilities in. Request responses to address each area.

1) Network Engineering (On-premises and GovCloud environment) Support:

The contractor shall provide expert-level network engineering support throughout the contract lifecycle, encompassing both current and emerging technologies. This support shall cover the full spectrum of design, implementation, maintenance, and security sustainment of the various DISA and OE network infrastructure across on-premises and various GovCloud environments, including Impact Level 5 (IL5) and IL6.

Describe your expertise in establishing seamless and secure hybrid cloud connectivity, addressing the complexities of system authentication, network security, and integration with DoD network services. Include a proven ability to troubleshooting and timely resolving connectivity issues while adhering to stringent DoD network security requirements. Discuss the level of technical expertise with appropriate clearance levels that demonstrate expertise implementing seamless and secure network connectivity, timely resolutions to critical issues, while applying the Department of Defense (DoD) network security requirements.

Furthermore, the contractor shall be capable of implementing and sustaining high-performance hybrid network infrastructures characterized by robust load balancing, low latency, and effective intrusion prevention systems (IPS), along with experience in penetration testing, network security audits, network performance monitoring, and optimization for DISA and OE. To assist DISA and OE mission needs, experience developing and managing Cross Domain Solutions (CDS) for secure information sharing between different security classifications is essential.

Discuss your experiences implementing and exercising cross-domain capabilities in accordance with DoD CDS policies, procedures, security standards, and regulations within on-premises and multiple GovCloud IL5/IL6 environments.

2) System Engineering (On-premises and GovCloud Environments):

The contractor shall provide system engineering support for on-premises enclaves and various GovCloud environments, including Impact Level 5 (IL5) and IL6, to facilitate Modeling and Simulation analysis for DISA programs. This support shall encompass the design, deployment, and management of Elastic Compute Cloud instances with high availability and fault tolerance.

Specific for the GovCloud environments, describe expertise in:

· Designing and implementing secure cloud architectures;

· Automating infrastructure provisioning and configuration management using Infrastructure as Code (IaC);

· Managing and optimizing cloud resources for cost efficiency;

· Implementing and managing cloud-native services such as serverless computing, container orchestration, and managed databases;

· Integrating GovCloud environments with on-premises systems and other cloud platforms; and

· Ensuring compliance with FedRAMP and other relevant cloud security standards.

The contractor shall also configure cloud storage, implement data backup/recovery solutions, and develop automated tools for system performance monitoring. Adhering to Capability Maturity Model Integration (CMMI) Level 4 practices is required to ensure system stability and efficient management. The contractor shall possess demonstrated expertise in migrating existing on-premises systems to GovCloud and integrating systems with other DISA programs.

The contractor is required to discuss the level technical expertise to implementing, configuring, integrating, and managing these environments, including the tools and processes used for system lifecycle adherence, performance monitoring and tuning, and timely troubleshooting.

As DISA’s commitments are to maintain systems with the highest standards of Cybersecurity, the contractor shall detail their experience implementing DevSecOps practices to integrate security into the system development lifecycle for both on-premises and cloud-based systems. This shall include demonstrated experience with automated security testing, vulnerability scanning, hardening Linux and Windows virtual machines (VMs), applying Server Certification processes, and implementing DISA Security Technical Implementation Guide (STIG) compliant VM security configurations. The contractor shall identify available personnel with appropriate clearance levels and relevant technical skills.

Describe and provide an example of how you have previously implemented DoD system engineering standards and best practices to integrate security components into the system development lifecycle for on-premises and IL5/IL6 cloud-based systems.

3) System Administration and Maintenance (On-premises and GovCloud Environments):

The contractor shall demonstrate proficiency in administering and maintaining servers and applications hosted on on-premises and various IL5/IL6 GovCloud platforms, including those configured with Windows and Linux operating systems. Critical to this effort is cross-domain maintenance of GovCloud IL5 and IL6 platforms. Specific GovCloud system administration and maintenance tasks shall include, but are not limited to: managing virtual machine instances, storage volumes, and network configurations; implementing and maintaining security controls such as access control lists, firewalls, and intrusion detection/prevention systems; patching and updating operating systems and applications; performance monitoring and tuning; capacity planning and management; disaster recovery planning and execution; and ensuring compliance with relevant DoD security standards and regulations. To support the high-performance for all systems and accommodate continuous system changes and growth, the contractor shall leverage CMMI Level 4 DevOps practices. This collaboration shall include knowledge transfer and active involvement of government personnel in the sustainment activities.

Describe and provide an example of you experience to support the evolving capabilities of IL5 and IL6 cloud-based systems, including their experience with:

· scripting and automation tools;

· managing various GovCloud computing platforms;

· securing user access;

· proactively addressing user requests;

· performing timely troubleshooting and resolution of system issues;

· providing comprehensive technical documentation and reports; and

· transparently collaborating with government personnel to ensure high-performance system administration and maintenance.

4) Security and Compliance (On-premises and GovCloud Environments):

The contractor shall support the development and execution of the Accreditation To Operate (ATO) process for systems hosted on on-premises and various IL5/IL6 GovCloud environments. Leveraging the DISA Risk Management Framework (RMF), including NIST SP 800-53 Revision 5 and eMASS, is required. This includes implementing and validating compliance with DoD IA Standards.

Describe and provide an example of your experience implementing these security controls, specifically addressing security hardening measures for Windows and Linux systems in accordance with STIG requirements;

data security through Data Loss Prevention (DLP) solutions and encryption technologies;

robust access control mechanisms;

regular system security and vulnerability scanning and remediation; and the development and execution of incident response plans.

Describe your experience with cybersecurity assessment scanning tools utilized to ensure compliance with security and vulnerability benchmarks.

Describe and provide an example of your company’s ability to implement and maintain robust security controls to protect DoD systems and data across all on-premises and GovCloud environments.

5) Other Engineering Support (On-premises and GovCloud environments):

The contractor shall provide on-demand engineering support services for Windows and Linux systems hosted on on-premises enclaves and various IL5/IL6 GovCloud environments. This includes experience with: comprehensive system administration and maintenance; supporting users in complex use cases; facilitating data file transfers and communications between on-premises, GovCloud IL5 and IL6 environments; proficiency in relevant technologies and best practices; delivering timely and comprehensive After Action Reports (AARs); promptly handling ad-hoc system requests; and installing and verifying the functionality of on-demand applications.

Describe and provide an example of your company’s ability to rapidly respond to urgent situations and address ad-hoc requirements.

Responses to each of the above items should state the total years of experience the company possesses with personnel currently on staff for each respective area.

SPECIAL REQUIREMENTS:

The contractor must have a Top-Secret facility security clearance. All classified work will be performed on premises at Fort George G. Meade. Provide a copy of your security clearance.

SOURCES SOUGHT:

The North American Industry Classification System Code (NAICS) for this requirement is 541512, with the corresponding size standard of $34M.

In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

SUBMISSION DETAILS:

Responses should include:

1) Business name and address;

2) Name of company representative and their business title;

3) Small Business Socio-economic status (if small);

4) CAGE Code;

5) Prime contract vehicles; to include ENCORE III, SETI. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.)

6) Up to five pages that demonstrate how the respondents can meet the five required capabilities listed above and the attached Performance Work Statement (PWS).

7) Submissions responding to capabilities one through five should state the total years of experience the company possesses with personnel currently on staff for each respective capability.

Businesses who wish to respond must send a response via email NLT 1:00 PM Eastern Daylight Time (EDT) on June 26, 2025 to sarah.a.thacker2.civ@mail.mil and daniel.g.limoges.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than five pages) demonstrating the ability to perform the services listed under Required Capabilities & Special Requirements.

Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

For information on DISA’s requirements, you can find current information on our home page: www.disa.mil – that includes current forecast and the current acquisition strategies. If there is no information regarding the requirement you may be inquiring about, then there is no additional publicly available information. Please continue to review www.disa.mil.

Page 2 of 4 Pages April 4, 2025

Page 1 of 5 Pages April 4, 2025