622572376 JPES-JCRM SSN.pdf

Page 1 of 5 Pages

SOURCES SOUGHT NOTICE

Tracking Number: 622572376

The Defense Information Systems Agency (DISA) Program Executive Office (PEO) Services is seeking sources for Joint Planning and Execution Services (JPES) and Joint Capabilities Requirements Manager (JCRM) Software Sustainment and Maintenance Requirement.

CONTRACTING OFFICE ADDRESS:

Defense Information Technology Contracting Organization (DITCO) National Capital Region

(NCR)

P.O. Box 549 Fort Meade, Maryland 20755-0549

INTRODUCTION:

This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of large and small businesses (including the following subsets: Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman-Owned Small Businesses) to provide the required products and/or services.

The DISA Global Force Management (GFM) Program Management Office (PMO) is seeking information from potential sources for: the JPES and JCRM Software Sustainment and Maintenance Requirement.

JPES is the modernized Joint Operations Planning and Execution System (JOPES), the DoD's primary system for planning and managing military operations, from the strategic level down to the tactical level. JCRM is the joint system used to identify force requirements in service of the GFM allocation process. It is a tool that takes operational plans inputted into the JOPES (soon to be replaced by JPES) and creates orders for those plans, which in turn are sent to the Department of Defense (DoD) secretary for authorization.

The scope of this effort includes Project Management, Configuration and Release Management, Risk Management, JPES & JCRM Software Sustainment, Tier 3 Help Desk Support, Testing and Evaluation, Information Assurance (IA) and Cybersecurity Support, and System Administration.

The anticipated Period of Performance is July 2026 through July 2027, with four, 12-month option periods, ending July 2031.

The anticipated Place of Performance includes: the contractor’s facility for unclassified work and on-site at DISA Headquarters – 6910 Cooper Ave. Ft Meade, MD 20755 for classified work.

Classified work includes Cybersecurity, Development in the Microsoft Azure IL6 Environment, and Information Assurance support.

DISCLAIMER:

Page 2 of 5 Pages

THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS

IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION

AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT.

RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER

NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO

FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS

NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY

VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND: The JPES and JCRM Software Sustainment and Maintenance requirement is a new requirement. However, portions of this requirement are currently being executed under the following:

Contract Number: 47QTCA15D001Q / HC104724F4001 Contract Vehicle: GSA MAS Incumbent: InterImage, Inc. – Woman Owned Small Business (WOSB) Method of previous acquisition: Sole Source Period of performance: March 2024 – September 2025

Contract Number: HC104725C4001 Contract Vehicle: None Incumbent: Trillion Technology Solutions, Inc. – 8(a) Small Business Method of previous acquisition: 8(a) Direct Award Period of performance: January 2025 – August 2026

Contract Number: HC104720D2045 Contract Vehicle: None Incumbent: Enterprise Resource Planning, International – Large Business Method of previous acquisition: Full and Open Competition Period of performance: September 2020 – September 2025

Existing contracts and orders may be extended to avoid breaks in service for mission essential tasks.

REQUIRED CAPABILITIES:

1) JPES and JCRM are operational programs that require continuous development.

Describe and provide an example of your company’s experience with Agile software development methodologies. Include specific examples of projects where Agile practices, such as Scrum or Kanban, were successfully implemented. Highlight your team's proficiency with Agile tools, techniques like sprint planning, daily stand-ups, end-of-sprint demos, and your ability to adapt to evolving requirements and deliver working software in short iterations.

2) IA and Cybersecurity are important to JPES and JCRM as operational systems with

Authority to Operate (ATOs). Describe and provide an example of your company’s

Page 3 of 5 Pages experience providing Cybersecurity and IA that utilizes the Risk Management Framework, such as:

• Updating Plans of Action and Milestones (POA&Ms) in the enterprise Mission Assurance Support Service (eMASS): explain your experience with eMASS and your process for creating, updating, and managing POA&Ms to track remediation efforts for identified vulnerabilities.

• Providing Commercial Off The Shelf (COTS) patch releases: describe your experience testing, validating, and deploying COTS patch releases in a timely and secure manner. Include your experience with change management procedures and rollback plans.

• Maintaining a fully Security Technical Implementation Guide (STIG)-compliant environment: detail your experience implementing and maintaining STIG configurations across an environment. Describe your experience with automated STIG compliance tools and your process for addressing deviations from STIG requirements.

3) JPES and JCRM are working towards a DevSecOps environment. Describe and provide an example of your company’s experience implementing DevSecOps principles and practices within software development lifecycles. Detail your experience integrating security seamlessly into each stage, from planning and development to testing, deployment, and operations. Explain your experience with Infrastructure as Code (IaC) and policy-as-code, and how you ensure security is baked into the infrastructure and application configurations.

4) JPES and JCRM maintain an on-premises SIPRNet lab environment that serves as both testing and a production mirror for critical functionalities. This environment is built upon a heterogeneous hardware infrastructure, comprising a variety of servers, switches, workstations, and storage devices from multiple vendors and with varying specifications.

Describe and provide an example of your company’s experience with:

• Managing and supporting heterogeneous hardware environments and diverse ecosystems consisting of servers (e.g., Dell, HP, Cisco UCS, Supermicro), switches (e.g., Cisco, Juniper, Arista), and storage devices (e.g., NetApp, EMC, Pure Storage, Nimble).

• Detail your company's experience with system administration of VMWare ESXi (state specific versions you have experience with). Include your experience with tasks such as virtual machine creation, configuration, performance monitoring, troubleshooting, and patching. To include experience with various versions of Red Hat Enterprise Linux (RHEL) and Windows Server.

5) JPES is deployed in a hybrid deployment environment (Microsoft Azure & on-premises) and JCRM will move to a similar environment if not 100% in the cloud. Describe and provide an example of your company’s experience in migrating on-premises applications to classified cloud environments (e.g., IL5, IL6, or equivalent). Provide examples of successful migrations, highlighting the challenges you overcame, the tools and techniques you utilized (e.g., containerization, orchestration, data encryption), and how you ensured compliance with all applicable security regulations and standards (e.g., Page 4 of 5 Pages

FedRAMP, ICD 503). Explain your experience with implementing zero trust principles and cloud-native security services within a classified cloud environment, and how you maintained the application's functionality and performance throughout the migration process.

6) JPES and JCRM could benefit from Artificial Intelligence (AI) integration to provide force planners with multiple Courses of Action to meet various scenarios. Describe and provide an example of your company’s experience in integrating AI into software products. Provide a detailed description of your experience, including specific examples of AI technologies implemented (e.g., machine learning, natural language processing, computer vision), the applications or industries they served, and the quantifiable benefits achieved through AI integration. Please also describe any challenges encountered during the integration process and your experience addressing them.

SPECIAL REQUIREMENTS:

The work to be performed under this contract/order is up to the Secret level. To be considered qualified and capable, Contractors must have a final Secret Facility Clearance from the Defense Counterintelligence and Security Agency Facility Clearance Branch at the time of proposal submission. Submit a copy of your current security clearance level.

SOURCES SOUGHT:

The North American Industry Classification System Code (NAICS) for this requirement is 541512 with the corresponding size standard of $34,000,000.00.

In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications.

Responses must demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

SUBMISSION DETAILS:

Responses should include:

1) Business name and address;

2) Name of company representative and their business title;

3) Small Business Socio-economic status (if small);

4) CAGE Code;

5) Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP4, NASA SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency

Page 5 of 5 Pages contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.)

6) Responses to the “Required Capabilities” described above.

Businesses who wish to respond must send a response via email NLT 4:00 PM Eastern Daylight Time (EDT) on July 7, 2025 to Sebrina.A.Lewis.civ@mail.mil and Michelle.L.Rand.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than ten pages) demonstrating the ability to perform the services listed under Required Capabilities.

Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

For information on DISA’s requirements, you can find current information on our home page:

www.disa.mil – that includes current forecast and the current acquisition strategies. If there is no information regarding the requirement you may be inquiring about, then there is no additional publicly available information. Please continue to review www.disa.mil.

mailto:Sebrina.A.Lewis.civ@mail.mil http://www.disa.mil/