ACAS SSN Final.docx

SOURCES SOUGHT ANNOUNCEMENT

Tracking Number: 842674622 The Defense Information Systems Agency (DISA) is seeking sources for the next-generation Assured Compliance Assessment Solution (ACAS) for the Program Acquisition Executive (PAE) Cyber Sensing Portfolio Management Office.

CONTRACTING OFFICE ADDRESS:

Defense Information Systems Agency DITCO-Scott PL8413 2300 East Drive Bldg. 3600 Scott AFB, IL 62225-5406

1. INTRODUCTION:

This is a SOURCES SOUGHT TECHNICAL DESCRIPTION to determine the availability and capability of small businesses and their subsets (Small Disadvantaged Businesses, HUBZone Firms, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, and Woman-Owned Small Businesses), to provide the required products and/or services.

The Cyber Sensing Portfolio Management Office is seeking information from potential sources for the following areas of support:

· A comprehensive scanning solution for all devices connected to the DoW Information Network (DoWIN).

· Network-based, host-based agent, and agentless scanning capabilities.

· Assessment of compliance with security controls, configuration best practices, and patch management.

· Support for various operating systems (e.g. Windows, UNIX/Linux, macOS, Cisco IOS, etc.) and device types.

· Support for cloud deployment utilizing at least FedRAMP high with Impact Level 5 (IL5) in the cloud.

· Scanning capabilities for cloud assets (e.g. AWS, Azure, OCI, GCP).

· Scanning capabilities for IoT and OT assets (e.g. Siemens, Rockwell, etc.), to include sensitive OT networks & environments.

· Scanning capabilities for container assets (e.g. Docker, Kubernetes, etc.).

· Scanning capabilities for web applications (e.g. ServiceNow).

· Enterprise license management.

The Government is looking for an Assured Compliance Assessment Solution Capability that provides a comprehensive scanning solution for approximately 11 million Department of War (DoW) devices. This includes:

· Sustaining on-premises capabilities.

· Expanding scanning to cover IoT, OT, container scanning, and cloud environments (e.g. AWS, Azure, OCI, GCP, etc.).

· Adhering to standards like SCAP, CVE, CPE, XCCDF, and OVAL.

· Automating network discovery, asset identification, and vulnerability scanning.

· Providing scalable architecture to support the entire Department.

The anticipated Period of Performance is:

· Base Year: January 1, 2029– December 31, 2029

· Option Year One: January 1, 2030 – December 31, 2030

· Option Year Two: January 1, 2031 – December 31, 2031

· Option Year Three: January 1, 2032 – December 31, 2032

· Option Year Four: January 1, 2033 – October 31, 2033

The anticipated Place of Performance is CONUS and OCONUS.

2. DISCLAIMER

THIS SOURCES SOUGHT IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS ANNOUNCEMENT. NO FUNDS ARE AVAILABLE TO PAY FOR THE PREPARATION OF RESPONSES TO THIS ANNOUNCEMENT. ANY INFORMATION SUBMITTED BY RESPONDENTS TO THIS TECHNICAL DESCRIPTION IS STRICTLY VOLUNTARY.

3. CONTRACT/PROGRAM BACKGROUND:

Contract Number: NNG15SC71B/HC108426F0066 Contract Vehicle: NASA SEWP V Incumbent and their size: FCN, INC (Women-Owned Small Business) Method of previous acquisition: SBSA Period of Performance: 27 Dec 2025 – 26 Dec 2026

4. REQUIRED CAPABILITIES:

1. Describe your experience with the following cybersecurity and management tools:

· Current DoW vulnerability management solution

· Other relevant vulnerability management or endpoint security tools

2. Describe your experience providing contracted services to the DoW or other US Government customers in deploying, operating, and maintaining solutions in an enterprise environment (on-premises, hybrid, and cloud).

3. Describe your experience migrating solutions from on-premises to cloud-based environments. Note any issues encountered, the planning process used, and the outcome.

4. Describe your experience transitioning from a vulnerability management solution.

5. Describe your experience with federal standards (NIAP, STIGS, FIPS 140-2).

6. Describe your demonstrated expertise with Problem Resolution, Enterprise Help Desks, and your Tier III support processes, including providing 24x7 critical support.

5. SPECIAL REQUIREMENTS:

Personnel must have the appropriate clearances on day one of the contract, which can be up to TS/SCI. Please provide your current Facility Clearance Level (FCL).

All personnel supporting cybersecurity functions must have the appropriate IA certification in accordance with DoDD 8140.03-M.

6. SOURCES SOUGHT

The anticipated North American Industry Classification System (NAICS) Code for this requirement is 541519 (Information Technology Value Added Resellers) or 513210 (Software Publishers). This notice requests responses from all interested businesses.

In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

7. SUBMISSION DETAILS:

Responses should include:

1) Business name and address.

2) Name of company representative and their business title.

3) Small Business Socio-economic status (if small).

4) CAGE Code.

5) Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP4, NASA SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.)

Businesses who wish to respond must send a response via email NLT 4:00 PM Eastern Daylight Time (EDT) on June 4, 2026 to Adam Venhaus at adam.m.venhaus.civ@mail.mil and LTC Rhett Zietlow at rhett.c.zietlow.mil@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than five pages) demonstrating the ability to perform the services listed under Required Capabilities.

Proprietary information and trade secrets, if there are any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

For information on DISA’s requirements, you can find current information on our home page: www.disa.mil – that includes current forecast and the current acquisition strategies. If there is no information regarding the requirement you may be inquiring about, then there is no additional publicly available information. Please continue to review www.disa.mil.