Sources Sought DCMA CSS Recompete_FINAL.docx

SOURCES SOUGHT ANNOUNCEMENT

Tracking Number 642674444

The Defense Information Systems Agency (DISA) is seeking skilled contract labor support to achieve the tactical, operational and strategic cybersecurity goals of the Department of Defense (DoD) and Defense Contract Management Agency (DCMA).

CONTRACTING OFFICE ADDRESS: Defense Information Technology Contracting Organization - National Capital Region (DITCO-NCR / PS6)

INTRODUCTION:

This is a SOURCES SOUGHT ANNOUNCEMENT to determine the availability and technical capability of small businesses (including the following subsets; Small Disadvantaged Businesses, HUBZone Small Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses and Woman-Owned Small Businesses) to provide the required products and/or services.

DCMA’s Cyber Security Directorate is seeking information for potential sources for skilled contract labor support to achieve the tactical and strategic cybersecurity goals of the DoD and DCMA. Areas of focus include cybersecurity management, compliance, and engineering support and includes services and support related to cybersecurity, including program management, enterprise risk management, compliance auditing, plan of action and milestone (POA&M) management, privacy, cyberspace operations management, systems access controls and management, training, policy, cyber incident analysis & investigations, forensic analysis & investigations, engineering, vulnerability assessment management, and insider threat support.

The anticipated period of performance is:

Base Year: 8 Feb 2027 – 7 Feb 2028 Option Year 1: 8 Feb 2028 – 7 Feb 2029 Option Year 2: 8 Feb 2029 – 7 Feb 2030

The anticipated place of performance is: The primary place of performance for this requirement will be Government facilities at DCMA Atlanta, located near Smyrna, GA, and DCMA Headquarters, located at Fort Gregg-Adams, VA. The Government anticipates a hybrid work model where the contractor may authorize eligible personnel to telework up to two days per week from a location within the Continental United States (CONUS). All authorized telework is contingent upon maintaining adequate on-site coverage at all times, as approved by the Government. However, telework is not authorized for certain mission-essential roles, including but not limited to Cyberspace Defense Watch Officer (CDWO) support, incident management, digital forensics, insider threat support, and PKI/token issuance functions. Personnel assigned to these specified tasks will be required to be on-site full-time. The Government reserves the right to modify telework privileges based on mission requirements.

DISCLAIMER:

THIS SOURCES SOUGHT ANNOUNCEMENT IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS ANNOUNCEMENT. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS ANNOUNCEMENT. ANY INFORMATION SUBMITTED BY RESPONDENTS TO THIS SOURCES SOUGHT ANNOUNCEMENT IS STRICTLY VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND:

Contract Number: 47QTCA18D002A/HC104723F4060 Contract Vehicle: GSA MAS Incumbent and their size: CREST SECURITY ASSURANCE LLC / Small Method of previous acquisition: 8(a) small business set-aside Period of Performance: 8 Feb 2024 – 7 Feb 2027

REQUIRED CAPABILITIES:

1) Cybersecurity Vulnerability Management (CVM). To ensure the continuous protection and resilience of agency networks, the Government seeks comprehensive, threat-informed CVM support. This support will independently execute vulnerability identification, analysis, mitigation, and verification across all classified and unclassified enterprise environments. The contractor must strictly comply with CJCSI 6510.01F and DoDI 8531.01. They must also use official asset inventories for 100% credentialed scanning with tools such as Tenable (ACAS) and quickly correlate discovered vulnerabilities with active threat intelligence to measure operational risk. This capability must support the agency’s Zero Trust Architecture (ZTA) by feeding vulnerability data to policy enforcement points through automated Application Programming Interface (API) integrations. It must also ensure US Cyber Command Information Assurance Vulnerability Management (IAVM) reporting deadlines are met. The contractor will act as the central synchronization hub. They will coordinate with Information System Owners, IT Operations, and Compliance teams to drive automated patching and design alternative architectural mitigations. The contractor is required to conduct rapid verification rescans to validate remediation. They must also drive continuous programmatic maturity through metric tracking, including Mean Time to Patch (MTTP). Describe and provide an example of your company’s experience and approach to ensure compliance with CVM mandates with implementation measures.

2) Incident Response. To protect the Department of Defense Information Network (DoDIN) and the agency’s key assets, the Government requires a responsive Cybersecurity Incident Handling capability that provides continuous detection and remediation. The contractor must deliver 24x7x365 monitoring, using authorized Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) platforms to identify, validate, and triage security alerts. This includes threat hunting, daily system health checks, and the generation of incident reports in compliance with CJCSM 6510.01B. Upon detection, the contractor must shift to incident response, managing the investigation to determine root cause, scope, and impact. This requires containment strategies, coordinating remediation efforts like rule tuning and packet capture requests, and following DoD chain-of-custody protocols for digital artifacts. The contractor must escalate and notify stakeholders of any threats affecting Mission Critical Systems (MCS) or Mission Relevant Terrain - Cyber (MRT-C), ensuring the Government maintains situational awareness and the information needed to address cyber threats and restore network integrity. Describe and provide an example of your company’s experience in carrying out comprehensive Incident Response programs, including applicable cyber network defense operations.

3) Security Architecture Engineering Program (SAEP). To maintain an effective and compliant enterprise defense-in-depth posture, the Government requires contractor support to execute a unified SAEP. The increasing complexity of cyber threats requires a managed security architecture that integrates ZT principles, boundary defenses, and continuous Information Assurance (IA) system improvement. The agency requires engineering support to manage Enterprise Ports, Protocols, and Services Management (PPSM) in accordance with DISA and DoD directives (e.g., DoDI 8551.01, STIGs), ensuring all network traffic is registered, validated via SIEM log correlation, and follows least-privilege access models. The Government also requires lifecycle management, daily validation, and monthly policy updates for all critical IA tools—including the firewall, Malware Defenses, Data Loss Prevention (DLP), and Cloud-Based Internet Isolation (CBII)—to ensure these platforms operate effectively without high false-positive rates. By providing configuration audits, quick discrepancy resolution, thorough documentation, and technical coordination, this effort will keep the enterprise network security design robust, sound, and able to counter modern cyber threats. Describe and provide an example of your company’s experience supporting all administrative and technical management aspects of an SAEP.

4) In accordance with DoD instructions, CNSS 1253, NIST SP 800-18, NIST SP 800-30, NIST SP 800-37, NIST SP 800-53, NIST SP 800-53, and NIST SP 800-137, the contractor will provide comprehensive Risk Management Framework (RMF) support to the DCMA Cybersecurity Assessment & Authorization (A&A) and support authorization activities for DCMA information systems and technologies. Describe and provide an example of your company’s experience in supporting a government organization’s RMF program to include A&A activities over agency’s affected IT systems.

5) Audits Readiness. This program supports DCMA in conducting Cyberspace Resilience Evaluations. These evaluations are managed by the DoD Cyber Defense Command's (DCDC) J10 - Cyberspace Resilience Evaluation Directorate. DCDC J10 serves as the principal advisor to the Commander, DCDC, on all matters pertaining to DoDIN inspection, assessments, and audits to ensure the DoDIN is resilient against malicious cyber activity in a congested and contested cyberspace environment. Audits readiness support requires the vendor to define the criteria, methodology, capabilities, and capacities for all DoDIN inspections, assessments, and audits. The findings are then consolidated and fed into risk-based dashboards and the Joint Cyber Warfighting Architecture (JCWA) to inform strategic decision-making and provide a holistic view of the agency’s cybersecurity posture. Describe your experience operating within the confines of an audit readiness program and provide an example of supporting an organization through its cyberspace resilience assessments.

SPECIAL REQUIREMENTS:

The work to be performed will require a Top-Secret Facility Clearance. Please provide your current Facility Clearance level.

The work to be performed under this contract is up to the Top-Secret level. All contractor staff are required to have a minimum of a Secret clearance. Top Secret clearance will be required as needed.

SOURCES SOUGHT:

The anticipated North American Industry Classification System Code (NAICS) for this requirement is 541519 titled “Other Computer Related Services”, with the corresponding size standard of $34M.

To assist DISA in making a determination regarding the level of participation by small business in any subsequent procurement that may result from this Sources Sought Announcement, provide information regarding any plans to use joint venturing (JV) or partnering. Please outline how you would envision your company's areas of expertise and those of any proposed JV/partner would be combined to meet the specific requirements contained in this announcement.

In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company’s ability to perform in accordance with the Limitations on subcontracting clause (FAR 52.219-14).

SUBMISSION DETAILS:

Responses should include:

1) Business name and address;

2) Name of company representative and their business title;

3) Type of Small Business;

4) CAGE Code;

5) Your contract vehicles that would be available to the Government for the procurement of the product and/or service, to include ENCORE III, SETI, NIH, NASA SEWP, General Service Administration (GSA): OASIS, ALLIANT II, VETS, STARS II, Federal Supply Schedules (FSS) (including applicable SIN(s)), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and does not preclude your company from responding to this announcement.)

Vendors who wish to respond must send responses via email NLT 1 May 2026, 12:00 PM Eastern Daylight Time (EDT) to aubri.e.dubose.civ@mail.mil and tammy.l.smith234.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than five pages) demonstrating the ability to perform the services listed under Required Capabilities and Special Requirements.

Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. Please be advised that all submissions become Government property and will not be returned. All Government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as described in 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

For information on DISA’s requirements, you can find current information on our home page: www.disa.mil – that includes current forecast and the current acquisition strategies. If there is no information regarding the requirement you may be inquiring about, then there is no additional publicly available information. Please continue to review www.disa.mil.

Page 3 of 4 Pages