Sources Sought ACAS 052626 FINAL 2.docx

OURCES SOUGHT ANNOUNCEMENT

Tracking Number: 842674622

The Defense Information Systems Agency (DISA) is seeking sources for the next-generation Assured Compliance Assessment Solution (ACAS) for the Program Acquisition Executive (PAE) Cyber Sensing Portfolio Management Office.

CONTRACTING OFFICE ADDRESS:

Defense Information Systems Agency DITCO-Scott PL8413 2300 East Drive Bldg. 3600 Scott AFB, IL 62225-5406

1. INTRODUCTION

This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of a scanning solution to scan an estimated 11 million devices (including information technology, Internet of Things (IoT) and Operational Technology (OT)) on the Department of Defense / War (DoD / DoW) Information Network (DODIN/DOWIN) for proper device configuration, current patching, and to identify system vulnerabilities and weaknesses.

The DISA PAE Cyber, Cyber Sensing Portfolio Management Office is seeking information from potential sources to determine the viability of a new/next generation scanning solution that allows for more frequent, highly accurate scanning with the ability to scale from one asset to the size of the DoW enterprise with scan results collected at a minimum every 72 hours, or more frequently as can be supported by the bandwidth, storage and infrastructure.

The current ACAS capability provides the DoW (Combatant Commands, Services, DoW Agencies and Field Activities, Combat Support Agencies, and other program approved organizations) a means for identifying and assessing assets and devices; and evaluating the design, security and compliance posture of DoW systems and networks. As a replacement for the current ACAS, Cyber Sensing Portfolio Management Office is seeking a solution that:

(1) covers the full range of network-based scanning, host-based agent and agentless scanning, log correlation, and passive traffic analysis capabilities;

(2) assesses compliance with security controls, configuration best practice guidelines, network and data segmentation, network architecture, and patch management;

(3) identifies vulnerabilities and weaknesses;

(4) sustains what we already have on-premises and allows for expansion to IoT, OT and the cloud;

(5) works on all types of assets/network infrastructure (i.e., Windows, UNIX/Linux and variants (e.g. Red Hat Enterprise Linux (RHEL), Solaris, Operating System (OS) X, Juniper Network Operating System (JUNOS)), Cisco Internetworking Operating System (IOS), and other operating systems; workstations, laptops, desktops, hand-held devices; servers; infrastructure assets (e.g., routers, switches); cloud based assets; cloud hosted assets; containers; networked user support devices, Internet Protocol (IP)-based telephony gear, copiers, printers, scanners, facsimile; computers that control physical devices such as thermostats, refrigerators, light switches, IoT, other OT, etc.);

(6) facilitates and handles growth as new technologies emerge, opportunities for consolidation are identified, new standards are accepted/established by the DoD, and new customers/customer demands arise and need to be met.

Information on the solution and available professional services is being sought.

The Cyber Sensing Portfolio Management Office is chartered with helping DoW customers leverage provided and emerging endpoint security solutions. The ACAS team identifies and implements scalable enterprise scanning solutions, provides engineering consultations, troubleshooting and other support, provides training, and continuously assesses emerging technologies and solutions to enhance capabilities. The ACAS team is committed to increasing the security posture of the DoW by providing tools that effectively assess and provide accurate information, enhance awareness, and enable compliance to defend and protect the United States of America.

The anticipated Period of Performance is:

· Base Year: January 1, 2029– December 31, 2029

· Option Year One: January 1, 2030 – December 31, 2030

· Option Year Two: January 1, 2031 – December 31, 2031

· Option Year Three: January 1, 2032 – December 31, 2032

· Option Year Four: January 1, 2033 – October 31, 2033

The anticipated Place of Performance is CONUS and OCONUS.

2. DISCLAIMER

THIS SOURCES SOUGHT IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS ANNOUNCEMENT. NO FUNDS ARE AVAILABLE TO PAY FOR THE PREPARATION OF RESPONSES TO THIS ANNOUNCEMENT. ANY INFORMATION SUBMITTED BY RESPONDENTS TO THIS TECHNICAL DESCRIPTION IS STRICTLY VOLUNTARY.

3. CONTRACT/PROGRAM BACKGROUND

Contract Number: NNG15SC71B/HC108426F0066 Contract Vehicle: NASA SEWP V Incumbent and their size: FCN, INC (Women-Owned Small Business) Method of previous acquisition: SBSA Period of Performance: 27 Dec 2025 – 26 Dec 2026

4. REQUIRED CAPABILITIES

The Cyber Sensing Portfolio Management Office is seeking information from potential sources for the following areas of support:

· A comprehensive scanning solution for all devices connected to the DoW Information Network (DoWIN).

· Network-based, host-based agent, and agentless scanning capabilities.

· Assessment of compliance with security controls, configuration best practices, and patch management.

· Support for various operating systems (e.g. Windows, UNIX/Linux, macOS, Cisco IOS, etc.) and device types.

· Support for cloud deployment utilizing at least FedRAMP high with Impact Level 5 (IL5) in the cloud.

· Scanning capabilities for cloud assets (e.g. AWS, Azure, OCI, GCP).

· Scanning capabilities for IoT and OT assets (e.g. Siemens, Rockwell, etc.), to include sensitive OT networks & environments.

· Scanning capabilities for container assets (e.g. Docker, Kubernetes, etc.).

· Scanning capabilities for web applications (e.g. ServiceNow).

· Enterprise license management.

The Government is looking for an Assured Compliance Assessment Solution Capability that provides a comprehensive scanning solution for approximately 11 million Department of War (DoW) devices. This includes:

· Sustaining on-premises capabilities.

· Expanding scanning to cover IoT, OT, container scanning, and cloud environments (e.g. AWS, Azure, OCI, GCP, etc.).

· Adhering to standards like SCAP, CVE, CPE, XCCDF, and OVAL.

· Automating network discovery, asset identification, and vulnerability scanning.

· Providing scalable architecture to support the entire Department.

Respondents are directed to review the associated spreadsheet (Attachment: ACAS 2026 Requirements FINAL.xlsx), which outlines the detailed technical specifications and all applicable ACAS requirements.

5. SPECIAL REQUIREMENTS

Personnel must have the appropriate clearances on day one of the contract, which can be up to TS/SCI. Please provide your current Facility Clearance Level (FCL).

All personnel supporting cybersecurity functions must have the appropriate IA certification in accordance with DoDD 8140.03-M.

6. SOURCES SOUGHT

The anticipated North American Industry Classification System (NAICS) Code for this requirement is 541519 (Information Technology Value Added Resellers) or 513210 (Software Publishers). This notice requests responses from all interested businesses.

In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

7. SUBMISSION DETAILS

Responses should include:

1. Business name and address.

1. Name of company representative and their business title.

1. Small Business Socio-economic status (if small).

1. CAGE Code.

1. Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP4, NASA SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.)

Businesses who wish to respond must send a response via email NLT 4:00 PM Eastern Daylight Time (EDT) on June 11, 2026 to Adam Venhaus at adam.m.venhaus.civ@mail.mil and LTC Rhett Zietlow at rhett.c.zietlow.mil@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than five pages) demonstrating the ability to perform the services listed under Required Capabilities.

Proprietary information and trade secrets, if there are any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

For information on DISA’s requirements, you can find current information on our home page: www.disa.mil – that includes current forecast and the current acquisition strategies. If there is no information regarding the requirements you may be inquiring about, then there is no additional publicly available information. Please continue to review www.disa.mil.