622673683 DPIMS SSN 02182026.docx

CUI

SOURCES SOUGHT NOTICE

Tracking Number 622673683

The Defense Information Systems Agency (DISA) is seeking sources for Department of Defense (DoD) Privacy Information Management System (DPIMS)

CONTRACTING OFFICE ADDRESS: DISA/DITCO-FORT MEADE-PSD

INTRODUCTION:

This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of small businesses (including the following subsets: Small Disadvantaged Businesses, certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman-Owned Small Businesses) to provide the required products and/or services.

DISA is seeking information from potential vendors to support the sustainment of DPIMS. DPIMS is an enterprise-wide platform that consolidates Breach Reporting and delivers improved efficiency, compliance, and analytics across all Combatant Commands, Services, and Agencies.

DPIMS is part of DISA's strategy to consolidate data from various disparate systems (e.g. email, collaboration tools, VoIP, and ITSM) into a new enterprise solution. The DPIMS solution offers enhancements, capabilities, standardization, and efficiencies that simply couldn't be achieved by trying to consolidate the existing legacy systems. DPIMS represents a significant departure from the previous breach reporting systems and processes used at lower levels within the DoD. DPIMS is a modern, centralized, and standardized solution that has been designed to replace the fragmented and inefficient legacy systems used for breach reporting across the DoD. DPIMS aims to improve data management, streamline processes, and provide better analytical insights.

The DPIMS enterprise platform is accessible on a Non-Secure Internet Protocol Router Network (NIPRNet / NIPR). It is a Commercial-off-the Shelf solution that is hosted in a DoD approved, Azure GovCloud IL5 environment as a Software-as-a-Service (SaaS) solution. It currently provides broad case management capabilities such as flow/sub-flows, import/export capabilities, normalization of legacy data, role-based functionality, reporting (pre-built and ad-hoc), content federation, work-flow assignments, notifications, authorization controls, claims service automation, analytics and dashboards using a single sign on portal for consolidation and reporting. The offer will need to sustain services utilizing the current platform.

The offeror must provide the same capabilities that the current solution offers. It must be implemented using an Azure GovCloud IL5 environment solution and must be connected to the NIPR enclave.

Period of Performance.

The anticipated Period of Performance will be one, 12-month base period and four, 12-month option years (to be exercised at the discretion of the Government). In addition, FAR clause 52.217-8 will be included which allows the Government to authorize performance for an additional 6 months if deemed necessary.

Place of Performance.

The anticipated place of performance for this Task Order will be the Contractor’s site, and at DISA Headquarters located at Ft. Meade MD

Travel in and around the primary place of performance may be required throughout the period of performance. Additional travel within CONUS may be required to support the requirements of this Performance Work Statement. Access to Secret Internet Protocol Router Network will be available at DISA Headquarters Acquisition Building, 6914 Cooper Ave, Fort Meade, MD 20755.

DISCLAIMER:

THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND:

The DPIMS modernization requirement is a new requirement. However, portions of this requirement are currently being executed under the following:

Contract Number: 47QTCA19D008D/HC104721F2087 Contract Vehicle: General Services Administration (GSA) Multiple Award Schedule (MAS) Method of previous acquisition: Small business set-aside Incumbent and their size: Diversified Technical Services, Inc., Small Business Period of performance: 24 September 2021 – 23 September 2026

REQUIRED CAPABILITIES:

DPIMS is a government-owned application operating on a Platform as a Service (PaaS) environment. The scope of this requirement includes all project management, operations and maintenance, configuration management, tiered help desk support, and cybersecurity services necessary to ensure the system remains secure, reliable, and fully operational. To demonstrate your company's capabilities, please describe and provide specific examples of your experience in the following areas:

Capability Area 1: Operations and Maintenance: The DPIMS system requires 24/7/365 availability. This involves daily system monitoring, database administration, performance tuning, and applying regular patches to the underlying platform and the application itself.

Describe and provide an example of your company’s experience providing operations and maintenance for a government-owned custom application hosted in a cloud environment (PaaS or IaaS), focusing on your methodology for ensuring uptime, managing backups, and conducting routine maintenance.

Capability Area 2: Cyber Security and ATO Maintenance. A primary task is the continuous maintenance of the DPIMS Authority to Operate (ATO). This requires active vulnerability management by monitoring systems like ACAS, responding to IAVMs, and maintaining a suite of security artifacts in eMASS. The solution securely connects to the Non‑Secure Internet Protocol Router (NIPR) enclave, implement safeguards to protect data in transit and at rest. It should ensure interoperability with existing DoD systems and networks hosted on NIPRNet, and include defined processes for managing access controls, monitoring, and incident response to maintain secure and compliant operations.

Describe and provide an example of your company’s experience maintaining the ATO for a DoD information system, specifically detailing your process for vulnerability remediation, annual security reviews, and continuous monitoring.

Capability Area 3: Tiered Technical Support: The contractor must provide Tier II and Tier III to help desk support to DPIMS users across the DoD enterprise, resolving complex technical issues that are escalated from the Tier I service desk.

Describe and provide an example of your company’s experience running a dedicated Tier II/III support team for a custom federal application. Please detail your approach to incident management, creating standard operating procedures (SOPs), and collaborating with government stakeholders.

Capability Area 4: Configuration and Release Management: All changes to the DPIMS application, whether for security patches, bug fixes, or minor enhancements, must be managed through a formal release process to ensure system stability.

Describe and provide an example of your company’s experience managing software releases for an active, operational system. Explain your process for testing, deploying, and documenting changes in a production environment.

SPECIAL REQUIREMENTS: Your company shall have a final security facility clearance. Personnel working on this contract must be US Citizens. Personnel must also be able to obtain a Secret security clearance level. Provide your current Facility Clearance level.

SOURCES SOUGHT:

The North American Industry Classification System Code (NAICS) applicable for this requirement is 541512 (https://www.census.gov/naics/), with the corresponding size standard of $34,000,000 (https://www.sba.gov/document/support--table-size-standards).

To make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

SUBMISSION DETAILS:

Responses should include:

1) Information pertaining to required capabilities above;

2) Business name and address.

3) Name of company representative and their business title.

4) Small Business Socio-economic status (if small).

5) CAGE Code.

6) Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP4, NASA SEWP V, GSA: OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.)

Businesses who wish to respond must send a response via email NLT 4:00 PM Eastern Daylight Time (EDT) on March 6, 2026 to Korrina Taitano; korrina.l.taitano.civ@mail.mil and Sebrina Lewis; Sebrina.a.lewis.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than five pages) demonstrating the ability to perform the services listed under Required Capabilities and Special Requirements.

Proprietary information and trade secrets, if there are any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

For information on DISA’s requirements, you can find current information on our home page: www.disa.mil – that includes current forecast and the current acquisition strategies. If there is no information regarding the requirements you may be inquiring about, then there is no additional publicly available information. Please continue to review www.disa.mil.

Page 2 of 4 Pages

Page 1 of 5 Pages