Attachment 2 Master Device Endpoint Record (MDER).docx

This document is a Request for Information (RFI) from the Defense Information Systems Agency (DISA) for the next generation of the Assured Compliance Assessment Solution (ACAS), seeking industry input on a comprehensive endpoint security scanning solution. The RFI targets a solution to scan approximately 11 million devices across the Department of Defense, with requirements including network and host-based scanning, compliance assessment, and the ability to cover diverse asset types such as IoT, operational technology, and cloud environments. The target contract period is from November 1, 2025, through October 31, 2030, structured as a firm fixed price order with a base year and four option years.

Key technical requirements include standards-based scanning supporting NIST compliance, agent and agentless scanning capabilities, network discovery, asset identification, automated vulnerability assessment, and scalability to manage 100,000 fully authenticated devices and 250,000 unauthenticated devices. The current incumbent is Sirius Federal LLC under a NASA SEWP contract, and vendors are requested to submit a 20-page white paper response by April 24, 2025, to specific email addresses. Interested parties must complete an ACAS 3 Requirements spreadsheet and provide details on their proposed solution, technical characteristics, deployment approach, licensing model, and transition strategy.