DCMA IT Mission Support Sources Sought.docx

SOURCES SOUGHT NOTICE

Tracking Number 642674020

The Defense Information Systems Agency (DISA) is seeking sources for Defense Contract Management Agency (DCMA) Information Technology (IT) Mission Support.

CONTRACTING OFFICE: Defense Information Technology Contracting Organization - National Capital Region (DITCO-NCR/PS6)

INTRODUCTION: This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of small businesses to provide the required services. This includes the following subsets: Small Disadvantaged Businesses (SDB), Certified 8(a), Service-Disabled Veteran-Owned Small Businesses (SDVOSB), HUBZone Small Businesses, and Woman-Owned Small Businesses (WOSB).

DCMA is seeking information from potential sources for IT Mission Support requirements. The resulting contract will ensure the availability, reliability, integrity, and security of all DCMA IT services that provide critical acquisition insight information for DCMA users and business partners.

The anticipated Period of Performance (PoP) is one base year with four (4) one-year options with PoP starting in 2nd quarter of FY27.

Anticipated Place of Performance: Carson, CA; Columbus, OH; Bedford, MA; Fort Lee, VA; and Smyrna, GA.

DISCLAIMER: THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY VOLUNTARY.

CONTRACT & PROGRAM BACKGROUND: The DCMA IT Mission Support is a new requirement.

SCOPE OF WORK: The vendor shall provide comprehensive IT support for enterprise data centers, network infrastructure, and mission-hosted applications. DCMA’s environment sustains approximately 500+ servers (over 69% virtualized). To effectively manage and maintain this environment, the vendor must possess expert-level experience in the platforms, frameworks, and technologies listed below.

Core Technical Capabilities:

· Department of War (DoW) Zero Trust Architecture: Demonstrated experience implementing and sustaining solutions based on the DoW Zero Trust capability model and National Institute of Standards and Technology Special Publications (NIST SP) 800-207, with a specific focus on ensuring the availability and integration of all mission-specific components and capabilities not covered under the core Thunderdome solution.

· Higher Headquarters (HHQ) Compliance: Financial Improvement and Audit Readiness (FIAR), United States Cyber Command (USCYBERCOM) Tasking Orders (TASKORDs)/Information Assurance Vulnerability Management (IAVM), DISA Security Technical Implementation Guide (STIG)

· Infrastructure & Data Center: Virtual Infrastructure (e.g., VMware), Data Center Servers, Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS)

· Operating Systems: Windows OS, Linux, Windows Server

· Directory & Authentication Services: MS Active Directory, Lightweight Directory Access Protocol (LDAP), Public Key Infrastructure (PKI), Enterprise Identity, Credential and Access Management (e-ICAM)

· Database & Portal Support: (e.g., Oracle, Informatica, Microsoft Structured Query Language (MS SQL), MS SharePoint)

· Network & Security:

· Network Engineering & Traffic Shaping (e.g., F5 Local Traffic Manager (LTM) / Global Traffic Manager (GTM))

· Network Access Control (NAC) & Firewalls

· Vulnerability Remediation (e.g., Assured Compliance Assessment Solution (ACAS))

· Intrusion Prevention (e.g., FireEye) & Web Proxy (e.g., Menlo/Cloud-Based Internet Isolation (CBII))

· Log Aggregation & Security Information and Event Management (SIEM) (e.g., LogRhythm)

· Privileged Access Management (PAM)

· Systems & Asset Management:

· Configuration Management (e.g., GitLab)

· Patch Management (e.g., BigFix)

· Asset Management (e.g., Flexera)

· Enterprise Software License Compliance (e.g., Oracle, Adobe)

· Remote Access: Virtual Private Network (VPN) (e.g., Cisco AnyConnect, F5), Virtual Desktop Infrastructure (VDI) (e.g., VMware)

· Cloud Platforms: Azure, Government Furnished User Directory (GFUD)

REQUIRED CAPABILITES:

1) DCMA IT provides cyber infrastructure support which includes remediation of system vulnerabilities, hands-on firewall configuration support, and log aggregation according to DoD and federal standards. These solutions ensure all security weaknesses are rapidly closed and documented as prioritized by DCMA. Describe your experience providing cyber infrastructure support with all describe components of cyber security.

2) DCMA IT provides database support for mission critical enterprise applications. Database administration duties for all DCMA environments include installation, patching, and upgrades, performance tuning, monitoring, troubleshooting, and diagnostics support for enterprise applications. Database support includes referencing National Institute of Standards and Technology Security and Privacy NIST SP 800-53, Department of Defense Instruction (DoDI) 8500.01, DoDI 8510.01, and relevant Zero Trust Architecture guidance for performance. Describe your experience supporting database administration in DoD and Zero Trust Architecture.

3) DCMA IT requires identity, credential, and access management (ICAM) to ensure appropriate access control to data and applications in addition to providing authoritative data on the DCMA user community. DCMA manages authentication, authorization, and access management using a host of applications and components including Active Directory (AD), PKI, Online Certificate Status Protocol (OCSP), Domain Name System, Dynamic Host Configuration Protocol (DHCP) services, and LDAP integration leveraging user data stored in AD and the Integrated Database (IDB). Describe your experience utilizing the tools listed to provide identity and access management support.

4) DCMA IT provides web application support to ensure the stability, performance, and security of the DCMA web hosting environment. Responsibilities include the sustainment of web server infrastructure (Internet Information Services (IIS), F5), secure deployment of all application code, and 24x7 incident response to maintain 99.9% uptime and resolve critical outages within four hours. Describe your experience providing comprehensive web application support, detailing your approach to sustaining high-availability (99.9% uptime) web application environments.

5) DCMA IT provides timely, standardized, and repeatable deployment of software and patches across all managed devices to ensure the security and functionality of the DCMA enterprise. DCMA leverages the following to strengthen the overall cybersecurity posture in accordance with (IAW) DoDI 8500.01, and NIST SP 800-40. Describe your experience leveraging in accordance with (IAW) DoDI 8470.01, DoDI 8510.01, and NIST SP 800-128, for systems and patch management support.

6) DCMA IT provides Enterprise network and cybersecurity support services for the Wide Area Network (WAN) and Local Area Network (LAN) Infrastructure requiring support for operations and maintenance, installation and turn-up, security compliance, configuration control, design recommendations for upgrades to key systems and support for all associated network equipment. The supported network equipment includes telecommunications circuits, Voice over IP (VoIP), servers, storage, and network management tools and applications to include 24 hours a day, seven days a week (24x7) Network Operations Center (NOC) monitoring, alerting, reporting, and escalation management of mission operational assets and availability. Describe your company’s experience providing network support to include the services and network technologies.

SPECIAL REQUIREMENTS:

· Citizenship: All vendor personnel must be U.S. Citizens.

· Facility Clearance: The services provided under this task order requires access to classified information at the Secret level and controlled unclassified information (CUI). Must have Secret Facility Clearance. Please provide your company’s current Facility Clearance Level (FCL).

· Security Clearances & Certifications: Personnel must meet the baseline certification and clearance levels outlined below. Security investigations must be completed or in-process before performance begins.

Level

SOURCES SOUGHT: The North American Industry Classification System Code (NAICS) for this requirement is 541512 - Computer Systems Design Services, with the corresponding size standard of $34.0M (https://www.sba.gov/document/support--table-size-standards).

This Sources Sought Synopsis is requesting responses to the following criteria ONLY from small businesses that can provide the required services under the NAICS Code.

In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company’s ability to perform IAW with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

SUBMISSION DETAILS:

Responses should include:

1) Business name and address;

2) Name of company representative and their business title;

3) Small Business Socio-economic status (if small);

4) CAGE Code;

5) Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP4, NASA SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.)

Businesses who wish to respond must send a response via email NLT 4:00 PM Eastern Standard Time (EST) on March 16, 2026 to ahsan.h.mohammad.civ@mail.mil and tammy.l.smith234.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than five pages) demonstrating the ability to perform the services listed under Required Capabilities & Special Requirements.

Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

For information on DISA’s requirements, you can find current information on our home page: www.disa.mil – that includes current forecast and the current acquisition strategies. If there is no information regarding the requirement you may be inquiring about, then there is no additional publicly available information. Please continue to review www.disa.mil.

Page 1 of 5 Pages