832572545 PKE Sources Sought.pdf

Page 1 of 4 Pages

SOURCES SOUGHT NOTICE

Tracking Number 832572545

The Defense Information Systems Agency (DISA) is seeking sources for the Program Executive

Office (PEO) Cyber/ID21 Public Key Infrastructure (PKI) Program for Department of Defense

(DoD) Public Key Enabling (PKE) Engineering Support

CONTRACTING OFFICE ADDRESS:

DISA/Defense Information Technology Contracting Organization/PS8311

2300 East Drive, Building 3600

Scott Air Force Base, Illinois 62225

INTRODUCTION:

This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of small businesses (including the following subsets: Small Disadvantaged Businesses, Certified

8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and

Woman-Owned Small Businesses) to provide the required products and/or services.

DISA PEO Cyber/ID21 is seeking information from potential sources for PKE engineering support. The specific area of focus is the use of existing and emerging PKE capabilities for increased productivity and improved Information Assurance (IA) posture. The DoD PKE team has been chartered to develop custom enterprise solutions, create collaborative environments and ensure commercial products interoperate with the DoD PKI. DoD PKE is responsible for increasing the security posture of the DoD by providing a seamless security environment supporting Identify Management efforts within overarching goal of defending and protecting the

United States of America. The DoD PKE enhances business process and improves the IA posture of the DoD through widespread use of PK-Enabled applications.

The anticipated Period of Performance is August 2026 through August 2031.

The anticipated Place of Performance is DISA, Ft. Meade, MD and the contractor facility located within the National Capital Region.

DISCLAIMER:

THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS

IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION

AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT.

RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER

NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO

FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS

NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY

VOLUNTARY.

Page 2 of 4 Pages

CONTRACT/PROGRAM BACKGROUND: The PKE requirement is reestablishing a prior requirement that existed as a stand-alone contract/task order HC102808D2015 / 0026 until expiration on July 28, 2016. As DoD PKI prepares to provide Post Quantum Cryptographic

Algorithm support and transition to Algorithm Evolution supporting larger key sizes in an aggressive timeline, DoD Chief Information Officer (CIO) has requested PKE be reestablished to facilitate supporting the DoD’s transition to these new algorithms and key sizes.

Contract Number: HC102808D2015 / 0026

Contract Vehicle: ENCORE II, Large Business Suite

Incumbent and their size: Booz Allen Hamilton, Large Business

Method of previous acquisition: ENCORE II, Large

Period of performance: 29 January 2012 – 28 July 2016

In addition to reestablishing the PKE requirement, several PKE related tasks are currently being supported on the PKI Sustainment task order, HC104719D2035/HC102823F2002, and will be realigned to the reestablished PKE requirement. PKE is customer focused while the PKI

Sustainment contract/task order is solely focused on internal capabilities. Tasks and subtasks transitioning from HC104719D2035/HC102823F2002 include:

- 6.3 Task 3 – Public Key Infrastructure (PKI) Portfolio Sustainment,

- 6.5.1 Subtask 1 - External Certification Authority (ECA) Programmatic Support,

- 6.5.4 Subtask 4 – Registration Authority (RA) Support, and

- 6.5.8 Subtask 8 – Maintenance of Existing Custom Software.

Contract Number: HC104719D2035 / HC102823F2002

Contract Vehicle: Systems Engineering, Technology and Innovation (SETI), Small Business

Suite

Incumbent and their size: Riverside Engineering LLC (JV)

Method of previous acquisition: Small business set-aside

Period of performance: 4 October 2023 – 3 December 2026

All other tasks and subtasks on HC104719D2035/HC102823F2002 not being transitioned to

PKE that require support beyond 3 December 2026 will be procured via a separate acquisition.

REQUIRED CAPABILITIES:

1) The DoD PKE team supports an extremely broad yet technically detailed focus area.

Our mission is to support DoD customers in using existing and emerging PKI capabilities. DoD PKE must evaluate hardware or software product integration within the PKI infrastructure in compliance with DoD PKI policies. In some cases, custom software must be developed. Describe your experience deploying, configuring, testing, and/or using PKI infrastructure products (e.g., certificate authority software, database software, hardware security modules), stating specific products when possible. Also, describe your experience with custom software development, including the requirements it satisfied.

Page 3 of 4 Pages

2) DoD PKE exists to support our customers; therefore, customer support and outreach are our top priorities. Describe your experience supporting others in deploying systems to use an enterprise PKI, with a focus on techniques used during support (e.g., help desk, technical guides, on-site visits, ServiceNow/ITSM+/Helix).

3) DoD PKE provides engineering support to end users, system owners, system developers and help desk personnel for all issues concerning the use of PKI, PKI

Enablement, and PKI Trust. The range of support is broad and could be a basic support question, such as, “How do I resolve issues with getting derived credentials onto a mobile device,” or more complex, such as a request for on-site support to assist in the design of a security architecture to accept PKI credentials. Describe your experience configuring or testing the capabilities of Commercial Off the

Shelf products (e.g., network devices, servers, desktops, mobile devices, etc.) to use the services of an enterprise PKI.

4) The DoD PKE team develops custom tools to support the use of PKI credentials to access DoD networks and applications on systems with different security classifications. Describe your experience implementing new capabilities through development activities, such as developing new support for other data source providers, developing new support for smartcards and tokens, implementing support for new cryptographic algorithms and PKI standards, and developing new support for emerging web technologies.

5) The DoD PKE team supports PK Enablement requirements of Federal Partners outside of the DoD to ensure that their PKIs adhere to DoD Policies and procedures for secure operation. Describe your experience developing and maintaining

DoD PKI and other Federal agency PKI tools and capabilities in support of enterprise requirements. These requirements include algorithm evolution, post quantum cryptography, certificate authorities (CAs), online certificate status protocol, global directory services, hardware security modules and other PKI capabilities.

6) With the DoD networks constantly facing threats from adversaries, the need for enhanced network security is paramount to maintain cyber security. Describe your experience with developing an enhanced network security framework based on Zero Trust.

SPECIAL REQUIREMENTS:

Must have interim or final Secret Facility Clearance. Please provide your current Facility

Clearance level.

SOURCES SOUGHT:

The North American Industry Classification System Code (NAICS) for this requirement is

541512 with the corresponding size standard of $34.0M.

Page 4 of 4 Pages

In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications.

Responses must demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

SUBMISSION DETAILS:

Responses should include:

1) Business name and address;

2) Name of company representative and their business title;

3) Small Business Socio-economic status (if small);

4) CAGE Code;

5) Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP3, NASA SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.)

Businesses who wish to respond must send a response via email NLT 8:00 AM Central Daylight

Time (CDT) on September 2, 2025 to Contract Specialist, Lauren Koerkenmeier, at lauren.e.koerkenmeier.civ@mail.mil and Contracting Officer, Victoria Arentsen, at victoria.l.arentsen.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than five pages) demonstrating the ability to perform the services listed under Required Capabilities.

Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

For information on DISA’s requirements, you can find current information on our home page:

www.disa.mil – that includes current forecast and the current acquisition strategies. If there is no information regarding the requirement you may be inquiring about, then there is no additional publicly available information. Please continue to review www.disa.mil.

mailto:lauren.e.koerkenmeier.civ@mail.mil http://www.disa.mil/