ESEMS_Sources_Sought_15 June 2026.docx

SOURCES SOUGHT NOTICE

Tracking Number 842674854

The Defense Information Systems Agency (DISA) is seeking sources for Endpoint Security Event Management System for Project Manager Command & Control Infrastructure (PM C2I) and Network Enterprise Technology Command (NETCOM).

CONTRACTING OFFICE ADDRESS:

DISA/Defense Information Technology Contracting Organization /PS8411 2300 East Drive, Building 3600 Scott Air Force Base, Illinois 62225

INTRODUCTION:

This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of small businesses and large businesses (including the following subsets: Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman-Owned Small Businesses) to provide the required products and/or services.

PM C2I is seeking information from potential sources:

· To identify interest and request industry’s feedback on solutions to provide Cyber Security solutions and services for the Department of War (DoW) Information Network – Army as well as fielding, installation, training, technical publications, technical data packages/engineering data for provisioning of Army Enterprise and Tactical systems. Technical capabilities and services support the Army’s Unified Network Zero Trust Architecture initiatives including but not limited to: Endpoint Detection and Response (EDR), Security Incident and Event Management (SIEM), Comply to Connect (C2C), Asset Management, Advanced Analytics and Network/Security visualization, Data Brokering and integration with the Army’s Big Data Platform (BDP), integration with Identity Credentialing and Access Management (ICAM) services, and compliance with DoW Information Technology and Security policy and requirements.

· Specified tasks include:

1: Operate, maintain, and secure a global endpoint ecosystem utilizing Microsoft Defender for Endpoint (MDE) and Elastic Defend. Manage EDR capabilities across the Army Unified Directory Services (AUDS) endpoints. Enforce "default-deny" application controls, automated malware quarantine, removable media restrictions, and continuous behavioral telemetry collection. Automate the ingestion of structured threat data (STIX/TAXII) to block known threats. Additionally, perform enterprise-wide cryptographic discovery, inventory, and hardware readiness assessments to prepare DoWIN-A for PQC migration.

2: Support the orchestration and enforcement of the DoD's C2C framework to ensure only identified, compliant, and authorized devices access the DoWIN-A.

The 5-Step Framework: Execute the continuous lifecycle of (1) Discovery/Categorization of all traditional and non-traditional endpoints (IoT, Mobile, CPS/OT), (2) Interrogation of device health, (3) Auto-Remediation of vulnerabilities/STIGs, (4) Authorization via policy-based Network Access Control (NAC), and (5) Continuous Policy Enforcement.

Integration: Orchestrate security workflows by integrating the C2C orchestrator (e.g., Forescout) with ICAM, USIEM, EDR, and vulnerability management tools.

3: Build, federate, and maintain a hybrid-cloud USIEM ecosystem to provide enterprise-wide security monitoring, data aggregation, investigation and analytics.

Hybrid Federation: Sustain existing on-premises USIEM instances at Regional Cyber Centers (RCCs) while building and operating a centralized, fully managed USIEM instance hosted in a Government-provided cArmy Azure environment.

Data Engineering: Utilize the Elastic Stack, Kubernetes, Linux, Apache Kafka and Cribl to build Extract, Transform, Load (ETL) pipelines. Normalize ingested telemetry to a common schema and integrate with the Army’s Big Data Platform (Gabriel Nimbus) via Cross Cluster Search (CCS).

4: Host, administer, and maintain the "NETCOM Edge" Collaborative Development Environment (CDE) to support advanced data science and analytics.

Infrastructure: Design and maintain scalable, high-performance storage and GPU architectures on both NIPR and SIPR networks.

Data & Repository Management: Securely pipe normalized telemetry into the environment. Manage secure, vulnerability-scanned custom Python package repositories for data scientists.

Advanced Support: Provide Tier 3 subject matter expertise to enable cross-domain data analysis and robust data pipeline development.

The anticipated requirement is for a single-award IDIQ with an estimated contract ceiling of $850M.

The anticipated Period of Performance is 2-year base period followed by eight 1-year option periods.

Base Year(s): 29 March 2027 – 28 March 2029

The anticipated primary Place of Performance is centered at the Global Cyber Center, Ft. Huachuca, Arizona with government Project Manager contract oversight at Aberdeen Proving Ground, MD, and supports 4 Regional Cyber Centers that provide services covering Army Service Component Commands and major Army installations both CONUS and OCONUS.

DISCLAIMER:

THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND: The Endpoint Security Event Management System requirement is a consolidated follow-on requirement. All portions of this requirement are currently being executed under the following:

Contract Number: 47QTCK18D0047/HC108422F0258 Contract Vehicle: GSA Alliant 2 Multiple-Award Contract (MAC) Incumbent and their size: ECS Federal, Large Method of previous acquisition: Fair Opportunity Competition Period of performance: September 29, 2022 – September 28, 2027

Contract Number: W15P7T19D0037/W15P7T22F0093 Contract Vehicle: Responsive Strategic Sourcing for Services Multiple award IDIQ Incumbent and their size: Enterprise Resource Performance, Inc., Small Method of previous acquisition: Fair Opportunity Competition Period of performance: May 12, 2022 – May 11, 2027

REQUIRED CAPABILITIES: To successfully execute this effort, interested sources must demonstrate:

1. Large-Scale Integration: Proven experience managing EDR, C2C, and SIEM architectures across enterprises exceeding 800,000+ endpoints.

2. Zero Trust & IL5/IL6 Compliance: Deep understanding of DoD Cloud Computing Security Requirements, DISA STIGs, and Risk Management Framework (RMF) protocols.

3. Technology Stack Expertise: Proficiency as a systems integrator for Microsoft Defender, Elastic Stack, Forescout, and Azure cloud environments.

4. Innovation & Modernization: The ability to continuously evaluate the cyber landscape and proactively recommend/implement "best-of-breed" technologies to mature the Army's defensive posture.

Responses must detail experience and expertise with the technology outlined and answer the following questions:

1) Training and Technical Publication Development.

a. What is your capability for developing modern, learner-centric training products?

b. What is your approach to managing a classroom of military personnel? How do you manage and track individual course attendance, whether on-site or virtual, and provide effective learning for students with varying levels of technical backgrounds?

c.

2) Fielding, Field Support,and Installation.

a. Describe your ability to plan and execute simultaneous global fielding missions for multiple customers. What is your ability to staff technical subject matter expert support and installation teams to provide platform integrations on a wide range of military networking and data environments, both on-prem and cloud-based?

b. What is your experience providing field support services in both Continental United States and Outside Continental United States locations, including contingency theaters and hazardous duty areas? Describe your process for managing personnel deployments, including obtaining necessary security clearances, visas, and Technical Expert Status Accreditation.

c. Describe your approach to providing 24/7 help desk support and on-site Field Support Representative services. How do you troubleshoot and resolve issues. Include information on your facilities, equipment, and certified technicians and any experience with Army Enterprise Security Management Platform.

3) Modernization and Cybersecurity Management.

a. Describe your ability to evaluate new capabilities for integration and provide the requisite level of subject matter expertise for new capabilities.

b. Describe your ability to provide incident detection management and response for Global programs.

c. Describe your level of experience with Development, Security, and Operations (DEVSECOPS) pipelines.

d. Describe your ability to develop and apply analytics to assess or to monitor system health.

4) Data Management and System Administration

a. Detail your experience ensuring systems and personnel comply with DoW cybersecurity requirements, including Information Assurance Vulnerability Alerts, Security Technical Implementation Guides, and Risk Management Framework controls and implementation. Include whether or not you have been responsible for attaining Authorization To Operate for DoW systems.

b. What is your approach to providing system administration support? Describe your experience in troubleshooting system-level issues, applying patches, and coordinating with government Cyber Security offices or program office IT staff to resolve outages.

SPECIAL REQUIREMENTS:

Must have Top Secret Facility Clearance. Please provide your current Facility Clearance level.

Must be able to provide Top Secret cleared personnel for specified mission tasks/locations but all personnel must have a minimum clearance at the Secret level.

SOURCES SOUGHT:

The North American Industry Classification System Code (NAICS) for this requirement is 541519, with the corresponding size standard of $34M.

In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

SUBMISSION DETAILS:

Responses should include:

1) Business name and address;

2) Name of company representative and their business title;

3) Small Business Socio-economic status (if small);

4) CAGE Code;

5) Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP4, NASA SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.)

Businesses who wish to respond must send a response via email NLT 12:30 PM Eastern Daylight Time (EDT) on June 29, 2026 to shannon.k.jones.civ@army.mil, jennifer.l.kinser3.civ@mail.mil, and melyssa.d.lafontaine.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above demonstrating the ability to perform the services listed under Required Capabilities.

Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

For information on DISA’s requirements, you can find current information on our home page: www.disa.mil – that includes current forecast and the current acquisition strategies. If there is no information regarding the requirement you may be inquiring about, then there is no additional publicly available information. Please continue to review www.disa.mil.

Page 2 of 4 Pages

Page 1 of 5 Pages