CCMDs2DoDNet_SSN 1.pdf

SOURCES SOUGHT NOTICE

Tracking Number 6XX2026

The Defense Information Systems Agency, (DISA) J6, DoDNet Program Management Office (PMO) is seeking sources for Combatant Command (CCMD) Migration to the Department of Defense Network (DoDNet)

CONTRACTING OFFICE ADDRESS:

DISA

Defense Information Technology Contracting Organization (DITCO) - National Capital Region 6910 Cooper Avenue Fort Meade, MD 20755

INTRODUCTION:

This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of small businesses and large businesses to provide the required services.

DISA is seeking information from potential sources to migrate the Department of War’s (DoW) Combatant Commands’ (CCMD) common-use Information Technology (IT) Non- Classified Internet Protocol Router Network (NIPRNet) and Secret Internet Protocol Router Network (SIPRNet) requirements onto the DISA-managed DoDNet. This acquisition is being planned in response to a memo published from the DoW Chief Information Officer (CIO) on 22 May 2026 titled “Combatant Command Network Optimization Execution Guidance.” The memorandum states that “DISA will execute migrations for all unclassified (NIPR) and classified (SIPR) Common Use IT” for the CCMDs by the end of Fiscal Year (FY) 2028. The memorandum is attached to this notice for reference.

The eleven (11) CCMDs currently operate independent NIPRNet and SIPRNet environments. Each CCMD performs a unique mission and operates globally across both Continental United States (CONUS) and Other than Continental United States (OCONUS) locations. There are approximately 231,000 users and approximately 200 sites across the 11 CCMDs. Site locations are withheld from public release due to classified Combatant Command (CCMD) requirements.

DISA is seeking contractor support to migrate the common-use CCMD network and user requirements into the single DISA-managed environment, the DoDNet. This effort will include tasks for endpoint and network discovery, design, planning, and migration execution in order to transition to operations, and sustainment to the Government. The key objectives are to:

• Migrate 11 CCMDs (231,000 users, 200 global sites) common-use IT NIPRNet and SIPRNet environments to DoDNet by the end of the FY 2028.

• Provide a single contract with capability for all migration activities from customer contact, discovery effort, migration of networks and endpoints, and to transition to operations.

• Utilize best practice tools, techniques, processes, and procedures to provide the highest level of quality customer service.

• Generate innovative service delivery techniques that will allow for complete discovery and migrations by the end of the FY 2028, which is the timeframe mandated by the DoW CIO memo.

The anticipated Period of Performance is 30 August 2026 to 30 September 2028.

The anticipated Place of Performance is across approximately 200 Global sites.

DISCLAIMER:

THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY.

THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A

SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE

GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE

GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A

RESULT OF THIS ANNOUNCEMENT. NO FUNDS ARE AVAILABLE TO PAY FOR

PREPARATION OF RESPONSES TO THIS ANNOUNCEMENT. ANY INFORMATION

SUBMITTED BY RESPONDENTS TO THIS TECHNICAL DESCRIPTION IS

STRICTLY VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND:

The migration of the CCMD customers to the DoDNet Single Service Provider environment is a new requirement. A similar and related migration of the Defense Agencies and Field Activities (DAFA) to the DoDNet Single Service Provider environment is already underway.

This requirement must be executed in parallel, and without disturbing ongoing DAFA migrations.

REQUIRED CAPABILITIES:

Demonstrated knowledge and expertise in the following foundational technical capabilities is required.

Technical Capability

Description Why this is a critical capability

Identity, Credential, and Access Management

(ICAM)

Details the Identity Management, Active Directory (AD) forest trusts, domain consolidation plans, and specialized Global Directory configurations that have been engineered to connect legacy DAFA networks to DoDNet.

A primary pillar to achieve Zero Trust Architecture (ZTA) requirements, provide access controls, permissions, and end user lifecycle management from migration through ongoing sustainment. Requirement is to immediately leverage purpose-built scripts and integrations with service providers have been developed for efficiency.

Technical Capability

Description Why this is a critical capability

Zero Trust Architecture

(ZTA) &

Security Boundaries

Specific as-built network topologies, firewall rule sets, rapid onboarding methodology, and service availability tools developed to monitor the DoDNet Single Service Provider (SSP) boundary.

Foundation of the secure by design and ZTA enabled DoDNet environment. Required planning, design, and integration steps have been developed and operationalized over the past 4 years. Required to ensure common operating environment and scalability.

Infrastructure as Code (IaC) & Automation Scripts

Purpose built automation scripts, API connections, provisioning tools, and communications, used to rapidly migrate users, devices, data from legacy environments into the DES cloud/on-premises infrastructure.

Purpose built, automation tools using Bash, PowerShell, and Python that are hardened with PKI certificates and secure key exchanges. Required to learn, incorporate, and improve these for immediate use and continuity.

Migration Methodologies & Runbooks

The streamlined governance processes within the DoDNet System Engineering Framework (DSEF), Standard Operating Procedures (SOP), physical and virtual site survey data, and lessons-learned artifacts compiled while migrating the initial 22 DAFAs.

Required for immediate success and continuity of overall DoDNet processes. Immediate integration of all procedures to meet migration goals over the next two fiscal years. The overall strategies were previously developed over 6-12 months to gain migration efficiencies.

1. Technical & Schedule Feasibility:

o Explain, with detailed technical milestones and a draft Master Schedule, how your company would migrate all 11 CCMDs to the established DoDNet architecture to achieve full operational capability by the mandated September 30, 2028 deadline. Include the acquisition timeline for award into your Master Schedule (see paragraph 2 below for specified acquisition timelines).

o Identify any critical path items, technical dependencies, or schedule risks that would prevent completion by this date.

o Describe your approach to expediting the migration of complex CCMD environments prior to the September 30, 2028 deadline. Responses must detail how you plan to leverage existing automation, Infrastructure as Code (IaC), and pre-built deployment templates, or alternatively, propose a cost-effective methodology that prevents substantial duplication of Government costs.

2. Transition, Ingestion, and Ramp-Up Timeline:

o Detail your transition methodology, including the timeline required to stand up a fully cleared, globally deployed engineering and program management team, conduct exhaustive technical discovery, and run parallel operations to validate system integrity.

o Compressed Timeline Parameters: The Government estimates a competitive procurement cycle of approximately 220 days from solicitation release to contract award. Given the DoW CIO's non-negotiable mandate to complete all migrations by September 30, 2028, demonstrate your organization's capability to structure, execute, and accelerate all transition, ingestion, and validation activities. Responses must detail a realistic, risk-mitigated milestone schedule that fits within this condensed timeline to guarantee full compliance with the September 30, 2028 deadline.

3. Rough Order of Magnitude:

o Provide a rough order of magnitude (ROM) for successfully executing all 11

CCMD migrations within the mandated timeframe.

4. Risk Mitigation and Experience:

o What specific capabilities, tools (e.g., automated migration scripts, Zero

Trust enforcement integration), and lessons learned from similar multi-theater enterprise consolidations will your organization utilize to prevent operational disruption to active warfighting commands during migration?

o Identify your ability to immediately access a Secret-cleared workforce capable of deploying globally to CONUS and OCONUS sites to execute concurrent migrations of CCMDs.

5. Past Performance Submission Requirements o To validate capability statements, interested parties must submit up to three

(3) references of relevant past performance from the last five (5) years demonstrating relevant experience with large-scale, multi-theater network migrations. Each reference must include:

1. Contract and Order Number.

2. Total Contract Dollar Value (including options).

3. Contract Life Cycle Timeframe (start and end dates, identifying the active migration phase vs. steady-state phase).

4. Detailed Scope of Work demonstrating experience with complex multi-theater environments, Zero Trust Architecture implementation, and ICAM controls.

5. Contracting Officer’s Representative name and contact information.

SPECIAL REQUIREMENTS:

The contractor must possess a minimum SECRET level facility security clearance. Please provide your current Facility Clearance level.

SUBMISSION DETAILS:

Responses should include:

1) Business name and address;

2) Name of company representative and their business title;

3) Small Business socio-economic status (if small);

4) CAGE Code;

5) Prime contract vehicles for which this requirement may be within scope and ceiling;

6) In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications and experience to perform similar services for requirements similar to size and scope of the CCMD migrations. Responses must demonstrate the company’s ability to perform in accordance with the Limitations on Subcontracting clause (FAR 52.219-14).

Businesses who wish to respond must send a response via email no later than August 4, 2026 4:00 PM Eastern Daylight Time to Jonathan Chattler (jonathan.r.chattler.civ@mail.mil), Darrin Meyer (darrin.r.meyer.civ@mail.mil). In no more than fifteen (15) pages, interested businesses should submit a capabilities statement package, with responses to the required capability inquires stated above, demonstrating their ability to perform the services listed.

Proprietary information and trade secrets, if there are any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly.

All submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as described 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.