RFI_ESEMS 09252026.pdf

REQUEST FOR INFORMATION- Tracking Number - 842674854

The Defense Information System Agency is seeking white papers from industry to assist with the development and planning of a potential requirement for Endpoint Security Event Management System for Project Manager Command & Control Infrastructure (PM C2I) and Network Enterprise Technology Command (NETCOM).

THIS IS A REQUEST FOR INFORMATION (RFI) NOTICE ONLY. THIS IS NOT A

REQUEST FOR PROPOSALS (RFP). NO SOLICITATION IS AVAILABLE AT THIS TIME.

1. Overview/Purpose/ Description of Procurement

Request industry’s feedback on solutions to provide Cyber Security solutions and services for the Department of War Information Network – Army (DOWIN-A) as well as fielding, installation, training, technical publications, technical data packages/engineering data for provisioning of Army Enterprise and Tactical systems.

Technical capabilities and services support the Army’s Unified Network Zero Trust Architecture initiatives including but not limited to: Endpoint Detection and Response (EDR), Security Incident and Event Management (SIEM), Comply to Connect (C2C), Asset Management, Advanced Analytics and Network/Security visualization, Data Brokering and integration with the Army’s Big Data Platform, integration with Identity Credentialing and Access Management (ICAM) services, and compliance with Department of War (DOW) Information Technology and Security policy and requirements.

The anticipated primary place of performance is centered at the Global Cyber Center, Ft.

Huachuca, Arizona with government Project Manager contract oversight at Aberdeen Proving Ground, Maryland, and supports four Regional Cyber Centers that provide services covering Army Component Commands and major Army installation both Continental United States and Outside Continental United States

The Endpoint Security Event Management System requirement is a consolidated follow-on requirement. All portions of this requirement are currently being executed under the following:

Contract Number: 47QTCK18D0047/HC108422F0258 Contract Vehicle: GSA Alliant 2 Multiple-Award Contract (MAC) Incumbent and their size: ECS Federal, Other than Small Method of previous acquisition: Fair Opportunity Competition Period of performance: September 29, 2022 – September 28, 2027

Contract Number: W15P7T19D0037/W15P7T22F0093 Contract Vehicle: Responsive Strategic Sourcing for Services Multiple award IDIQ Incumbent and their size: Enterprise Resource Performance, Inc., Other than Small

Method of previous acquisition: Fair Opportunity Competition Period of performance: May 12, 2022 – May 11, 2027

2. Scope of Effort

1: Operate, maintain, and secure a global endpoint ecosystem utilizing Microsoft Defender for Endpoint and Elastic Defend. Manage EDR capabilities across the Army Unified Directory Services endpoints. Enforce "default-deny" application controls, automated malware quarantine, removable media restrictions, and continuous behavioral telemetry collection. Automate the ingestion of structured threat data to block known threats. Additionally, perform enterprise-wide cryptographic discovery, inventory, and hardware readiness assessments to prepare DOWIN-A for Post-Quantum Cryptography migration.

2: Support the orchestration and enforcement of the DOW C2C framework to ensure only identified, compliant, and authorized devices access the DOWIN-A. The 5-Step Framework: Execute the continuous lifecycle of (1) Discovery/Categorization of all traditional and non-traditional endpoints (Internet of Things, Mobile Devices/Mobile Technology, Cyber Physical Systems/Operational Technology), (2) Interrogation of device health, (3) Auto-Remediation of vulnerabilities/System Technical Implementation Guide, (4) Authorization via policy-based Network Access Control , and (5) Continuous Policy Enforcement. Integration: Orchestrate security workflows by integrating the C2C orchestrator (e.g., Forescout) with ICAM, USIEM, EDR, and vulnerability management tools.

3: Build, federate, and maintain a hybrid-cloud USIEM ecosystem to provide enterprise-wide security monitoring, data aggregation, investigation and analytics.

• Hybrid Federation: Sustain existing on-premises USIEM instances at Regional Cyber Centers while building and operating a centralized, fully managed USIEM instance hosted in a Government-provided Army Azure environment.

• Data Engineering: Utilize the Elastic Stack, Kubernetes, Linux, Apache Kafka and Cribl to build Extract, Transform, Load pipelines. Normalize ingested telemetry to a common schema and integrate with the Army’s Big Data Platform (Gabriel Nimbus) via Cross Cluster Search.

4: Host, administer, and maintain the "NETCOM Edge" Collaborative Development Environment to support advanced data science and analytics.

• Infrastructure: Design and maintain scalable, high-performance storage and Graphics Processing Unit architectures on both Non-classified Internet Protocol Router Network, Secret Internet Protocol Router Network networks.

• Data & Repository Management: Securely pipe normalized telemetry into the environment. Manage secure, vulnerability-scanned custom Python package repositories for data scientists.

• Advanced Support: Provide Tier 3 subject matter expertise to enable cross-domain data analysis and robust data pipeline development.

3. Technical Characteristics

See Performance Work Statement (PWS)

4. Requested Information

DISA is seeking industry feedback on requirement development and industry solutions.

Interested parties are requested to address the following in their white paper:

• Company information.

o Company name and website.

o Company point of contract name, phone, and email.

o Company’s Commercial and Government Entity (CAGE) code and the

PRIMARY North American Industry Classification System (NAICS) code that your organization utilizes; company business size and socioeconomic categories, if applicable.

• In your White Paper response to this Request for Information (RFI), please provide the following to help us develop and plan for this requirement, understand industry capabilities, and refine our approach:

1. Technical Approach and Innovation: Describe your technical approach to fulfilling the major requirements outlined in the Performance Work Statement (PWS), including Endpoint Detection and Response (Task 1), Comply-to-Connect (Task 3), and Unified Security Information and Event Management (USIEM) (Task 4). We are particularly interested in approaches that enhance automation, reduce the infrastructure footprint, and ensure seamless data integration within the broader Army security ecosystem.

2. Integration, and Data Strategy: Based on the scope of effort and detailed tasks in the PWS, identify the top 3–5 potential technical, logistical, and operational challenges or risks associated with implementing the program, including engineering and sustaining critical data integrations such as forwarding telemetry to the Army Big Data Platform (Gabriel Nimbus), maintaining interoperability with the Security Information and Event Management (SIEM) solution, and ensuring consistent data normalization, structuring, and enrichment. For each challenge, provide a specific, actionable recommendation or alternative solution to mitigate risk, improve performance, and increase efficiency, while ensuring data conforms to Army-specified schemas and supports advanced analytics, cross-domain visibility, and scalable mission operations.

3. Capabilities and Market Insights: Briefly outline your company’s direct experience and core competencies in delivering at least three of the following key areas at comparable scale and complexity:

a. Global Endpoint Detection and Response (EDR) management (specifically with Microsoft and Elastic tools).

b. Implementing Zero Trust Principles, specifically Comply-to-Connect (C2C) frameworks with integrated ICAM (specifically with Forescout, ISE, and x.509 certificate-based authentication)

c. Building and operating a federated, Security Information and Event Management (SIEM) system that supports both on-prem and cloud-based implementations (specifically with the Elastic Stack).

d. Supporting advanced data analytics environments and Post- Quantum Cryptography (PQC) readiness.

RESPONSE GUIDELINES:

Interested parties are requested to respond to this RFI with a white paper addressing Section 4, Required Information. Submissions should not exceed 3 pages, single spaced, 12-point type with at least one-inch margins on 8 1/2” X 11” page size. The response should not exceed a 20 MB e-mail limit for all items associated with the RFI response. Oral communications are not permissible. SAM.gov will be the sole repository for all information related to this RFI.

Companies who wish to respond to this RFI should send responses via email no later than October 9, 2026 @ 3:00pm, Eastern Daylight Time (EDT) to shannon.k.jones.civ@army.mil, melyssa.d.lafontaine.civ@mail.mil and bobby.j.drees-douglas.civ@mail.mil.

INDUSTRY DISCUSSIONS:

DISA representatives may choose to meet with potential offerors and hold one-on-one discussions. Such discussions would only be intended to obtain further clarification of potential capability to meet the requirements, including any development and certification risks.

QUESTIONS:

Questions regarding this announcement shall be submitted in either MS Word or PDF format by e-mail to melyssa.d.lafontaine.civ@mail.mil and bobby.j.drees-douglas.civ@mail.mil no later than October 5, 2026 @ 3:00pm, Eastern Daylight Time (EDT). Verbal questions will NOT be accepted. Answers to questions will be posted to SAM.gov within 2 business days. The Government does not guarantee that questions received after October 5, 2026 will be answered.

The Government will not reimburse companies for any costs associated with the submissions of their responses

DISCLAIMER:

mailto:shannon.k.jones.civ@army.mil mailto:melyssa.d.lafontaine.civ@mail.mil mailto:bobby.j.drees-douglas.civ@mail.mil mailto:melyssa.d.lafontaine.civ@mail.mil mailto:bobby.j.drees-douglas.civ@mail.mil

This RFI is not a Request for Proposal (RFP) and is not to be construed as a commitment by the Government to issue a solicitation or ultimately award a contract. Responses will not be considered as proposals nor will any award be made as a result of this synopsis.

All information contained in the RFI is preliminary as well as subject to modification and is in no way binding on the Government. FAR clause 52.215-3, “Request for Information or Solicitation for Planning Purposes”, is incorporated by reference in this RFI. The Government does not intend to pay for information received in response to this RFI. Responders to this invitation are solely responsible for all expenses associated with responding to this RFI. This RFI will be the basis for collecting information on capabilities available. This RFI is issued solely for information and planning purposes. Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received in this RFI that is marked “Proprietary” will be handled accordingly. Please be advised that all submissions become Government property and will not be returned nor will receipt be confirmed. In accordance with FAR 15.201(e), responses to this RFI are not offers and cannot be accepted by the Government to form a binding contract.